From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3EE55C433EF for ; Mon, 30 May 2022 10:03:11 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id C2498843D2; Mon, 30 May 2022 12:01:51 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="V/NSPtlg"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 02B6A84367; Mon, 30 May 2022 12:01:13 +0200 (CEST) Received: from mail-wr1-x449.google.com (mail-wr1-x449.google.com [IPv6:2a00:1450:4864:20::449]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 09D95843B2 for ; Mon, 30 May 2022 12:00:52 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=30pWUYgYKBmsJbLdUUPXXPUN.LXVd-KXXcURbcb.MNWg.MN@flex--ascull.bounces.google.com Received: by mail-wr1-x449.google.com with SMTP id g22-20020adfa496000000b002101fcd7c86so903579wrb.11 for ; Mon, 30 May 2022 03:00:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=jx+LvywqYv0XkHFxnO0UScQquof1GDdojNg1hZQ0veU=; b=V/NSPtlg5Mq0MAugLmdtLQSxtANAAdtbCsGdtEA1gcT1CLaLZN+BhYnC92g6oNxv2Q ocAH2xKqmT7nXZumrKq1f8sP76yKabmeiWGbonXl0NPAqz2MfTPQuK690WHxIBIESGok BBkaUq6Z3sYFZXlH28nvefRR1RvyltFSo5pd1gE67psntaEqy+sHH10or1xoSk2DudVh VoW4/6x1jo4CS82FIgOyP/LH1r95EsEa7m/S7LONYn/XD7/lIZsMiFNT8qEtQb2gE03O rnU9qnlS+SvTgz5akcmFodaxMR3LRQoCbyLkL9EU5g3QL5n0sAPduWO4EYv/dxmJ16cw h64g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=jx+LvywqYv0XkHFxnO0UScQquof1GDdojNg1hZQ0veU=; b=37nNZ1P35NJBI0MRpsrelZqx0vp45RbJjnKJTx4RsQPKJRiTEWg5CjhVweYcDwZoQZ 3Q/nknL5U+NFyacR2UIFaLiUJBquRgnq2L1iA8UWJWQK7bNgpPOYD+AFXMmvbbfxldCi Er3YdaJ+t9SKTsmV1yeIFWafSiYQYFv5hfxR2SX5oUPaJZdiD9YmhV7WbxI2nFO9w8JY 86aeRvVWVP7J2kxDXWxzQxLwrFgjR5kZ+8W/Kdgk6qjZJUrfKM3K+E2pZEbF7eqn3Obs ewWQPUNk57pfOmCkqAuNODmJ4BgwlXlolIRfGio0XLoQqCOHX9Id/K3Mv9v6c7eFpkw1 7t6A== X-Gm-Message-State: AOAM532GkHbKTIXt5JC1RLP2ZtHh94JpcG/W+tGyZ/fx2cs/82eRiCm7 JSqcenwgAZ6B/5O+EmeT3zyaugAGWhl5WgirLVVgIM77kOnZJB0VT5/IXW/k37a7QWTC/wUzvNu Jojaxa28iBF8GZC3I6691e+rIySG6EHpGvoR/c9AgBbLrhI56d3u/emAw8J0= X-Google-Smtp-Source: ABdhPJxYTGy48Htl/EZmLOz1/ogU7f8lKyosT9aTxulVavQtltsWtLHY6G3c0gxSQNnYchrWPc74fJMFufc= X-Received: from ascull.c.googlers.com ([fda3:e722:ac3:cc00:28:9cb1:c0a8:1510]) (user=ascull job=sendgmr) by 2002:a1c:ac89:0:b0:393:fbb4:f52c with SMTP id v131-20020a1cac89000000b00393fbb4f52cmr687798wme.0.1653904850587; Mon, 30 May 2022 03:00:50 -0700 (PDT) Date: Mon, 30 May 2022 10:00:11 +0000 In-Reply-To: <20220530100013.3753780-1-ascull@google.com> Message-Id: <20220530100013.3753780-12-ascull@google.com> Mime-Version: 1.0 References: <20220530100013.3753780-1-ascull@google.com> X-Mailer: git-send-email 2.36.1.124.g0e6072fb45-goog Subject: [PATCH v3 11/13] sandbox: Add libfuzzer integration From: Andrew Scull To: u-boot@lists.denx.de Cc: sjg@chromium.org, trini@konsulko.com, xypron.glpk@gmx.de, jonbottarini@google.com, seanga2@gmail.com, Andrew Scull Content-Type: text/plain; charset="UTF-8" X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean Add an implementation of LLVMFuzzerTestOneInput() that starts the sandbox on a secondary thread and exposes a function to synchronize the generation of fuzzing inputs with their consumption by the sandbox. Signed-off-by: Andrew Scull Reviewed-by: Simon Glass --- arch/sandbox/config.mk | 3 + arch/sandbox/cpu/os.c | 70 +++++++++++++++++++++++ arch/sandbox/include/asm/fuzzing_engine.h | 25 ++++++++ 3 files changed, 98 insertions(+) create mode 100644 arch/sandbox/include/asm/fuzzing_engine.h diff --git a/arch/sandbox/config.mk b/arch/sandbox/config.mk index 410603252e..3e2c7f9ebe 100644 --- a/arch/sandbox/config.mk +++ b/arch/sandbox/config.mk @@ -19,6 +19,9 @@ SANITIZERS := ifdef CONFIG_ASAN SANITIZERS += -fsanitize=address endif +ifdef CONFIG_FUZZ +SANITIZERS += -fsanitize=fuzzer +endif KBUILD_CFLAGS += $(SANITIZERS) cmd_u-boot__ = $(CC) -o $@ -Wl,-T u-boot.lds $(u-boot-init) \ diff --git a/arch/sandbox/cpu/os.c b/arch/sandbox/cpu/os.c index f229d1621a..3b230606a9 100644 --- a/arch/sandbox/cpu/os.c +++ b/arch/sandbox/cpu/os.c @@ -8,6 +8,7 @@ #include #include #include +#include #include #include #include @@ -26,6 +27,7 @@ #include #include +#include #include #include #include @@ -1003,7 +1005,75 @@ void os_relaunch(char *argv[]) os_exit(1); } + +#ifdef CONFIG_FUZZ +static void *fuzzer_thread(void * ptr) +{ + char cmd[64]; + char *argv[5] = {"./u-boot", "-T", "-c", cmd, NULL}; + const char *fuzz_test; + + /* Find which test to run from an environment variable. */ + fuzz_test = getenv("UBOOT_SB_FUZZ_TEST"); + if (!fuzz_test) + os_abort(); + + snprintf(cmd, sizeof(cmd), "fuzz %s", fuzz_test); + + sandbox_main(4, argv); + os_abort(); + return NULL; +} + +static bool fuzzer_initialized = false; +static pthread_mutex_t fuzzer_mutex = PTHREAD_MUTEX_INITIALIZER; +static pthread_cond_t fuzzer_cond = PTHREAD_COND_INITIALIZER; +static const uint8_t *fuzzer_data; +static size_t fuzzer_size; + +int sandbox_fuzzing_engine_get_input(const uint8_t **data, size_t *size) +{ + if (!fuzzer_initialized) + return -ENOSYS; + + /* Tell the main thread we need new inputs then wait for them. */ + pthread_mutex_lock(&fuzzer_mutex); + pthread_cond_signal(&fuzzer_cond); + pthread_cond_wait(&fuzzer_cond, &fuzzer_mutex); + *data = fuzzer_data; + *size = fuzzer_size; + pthread_mutex_unlock(&fuzzer_mutex); + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + static pthread_t tid; + + pthread_mutex_lock(&fuzzer_mutex); + + /* Initialize the sandbox on another thread. */ + if (!fuzzer_initialized) { + fuzzer_initialized = true; + if (pthread_create(&tid, NULL, fuzzer_thread, NULL)) + os_abort(); + pthread_cond_wait(&fuzzer_cond, &fuzzer_mutex); + } + + /* Hand over the input. */ + fuzzer_data = data; + fuzzer_size = size; + pthread_cond_signal(&fuzzer_cond); + + /* Wait for the inputs to be finished with. */ + pthread_cond_wait(&fuzzer_cond, &fuzzer_mutex); + pthread_mutex_unlock(&fuzzer_mutex); + + return 0; +} +#else int main(int argc, char *argv[]) { return sandbox_main(argc, argv); } +#endif diff --git a/arch/sandbox/include/asm/fuzzing_engine.h b/arch/sandbox/include/asm/fuzzing_engine.h new file mode 100644 index 0000000000..cf6396363b --- /dev/null +++ b/arch/sandbox/include/asm/fuzzing_engine.h @@ -0,0 +1,25 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * Copyright (c) 2022 Google, Inc. + * Written by Andrew Scull + */ + +#ifndef __ASM_FUZZING_ENGINE_H +#define __ASM_FUZZING_ENGINE_H + +/** Function to get fuzzing engine input data. */ +/** + * sandbox_fuzzing_engine_get_input() - get an input from the sandbox fuzzing + * engine + * + * The function will return a pointer to the input data and the size of the + * data pointed to. The pointer will remain valid until the next invocation of + * this function. + * + * @data: output pointer to input data + * @size output size of input data + * Return: 0 if OK, -ve on error + */ +int sandbox_fuzzing_engine_get_input(const uint8_t **data, size_t *size); + +#endif /* __ASM_FUZZING_ENGINE_H */ -- 2.36.1.124.g0e6072fb45-goog