Loading libs/vr/libpdx/fuzz/Android.bp 0 → 100644 +19 −0 Original line number Diff line number Diff line cc_fuzz { name: "libpdx_fuzz", clang: true, srcs: [ "service_dispatcher_fuzzer.cpp", ], cflags: [ "-Wall", "-Wextra", "-Werror", ], static_libs: [ "libpdx", ], shared_libs: [ "libutils", "liblog", ], } libs/vr/libpdx/fuzz/helpers.h 0 → 100644 +294 −0 Original line number Diff line number Diff line /* * Copyright 2020 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ // Authors: corbin.souffrant@leviathansecurity.com // brian.balling@leviathansecurity.com #ifndef LEV_FUZZERS_LIBPDX_HELPERS_H_ #define LEV_FUZZERS_LIBPDX_HELPERS_H_ #define UNUSED(expr) \ do { \ (void)(expr); \ } while (0) #include <fuzzer/FuzzedDataProvider.h> #include <pdx/client.h> #include <pdx/service.h> #include <pdx/service_dispatcher.h> #include <pdx/service_endpoint.h> #include <sys/eventfd.h> #include <memory> #include <vector> using namespace android::pdx; // Vector of operations we can call in the dispatcher. static const std::vector<std::function<void( const std::unique_ptr<ServiceDispatcher>&, FuzzedDataProvider*)>> dispatcher_operations = { [](const std::unique_ptr<ServiceDispatcher>& dispatcher, FuzzedDataProvider*) -> void { dispatcher->EnterDispatchLoop(); }, [](const std::unique_ptr<ServiceDispatcher>& dispatcher, FuzzedDataProvider*) -> void { dispatcher->ReceiveAndDispatch(); }, [](const std::unique_ptr<ServiceDispatcher>& dispatcher, FuzzedDataProvider* fdp) -> void { dispatcher->ReceiveAndDispatch(fdp->ConsumeIntegral<int>()); }}; // Most of the fuzzing occurs within the endpoint, which is derived from an // abstract class. So we are returning garbage data for most functions besides // the ones we added or need to actually use. class FuzzEndpoint : public Endpoint { public: explicit FuzzEndpoint(FuzzedDataProvider* fdp) { _fdp = fdp; _epoll_fd = eventfd(0, 0); } ~FuzzEndpoint() { close(_epoll_fd); } // Returns an fd that can be used with epoll() to wait for incoming messages // from this endpoint. int epoll_fd() const { return _epoll_fd; } // Associates a Service instance with an endpoint by setting the service // context pointer to the address of the Service. Only one Service may be // associated with a given endpoint. Status<void> SetService(Service* service) { _service = service; return Status<void>(0); } // Set the channel context for the given channel. Status<void> SetChannel(int channel_id, Channel* channel) { UNUSED(channel_id); _channel = std::shared_ptr<Channel>(channel); return Status<void>(0); } // Receives a message on the given endpoint file descriptor. // This is called by the dispatcher to determine what operations // to make, so we are fuzzing the response. Status<void> MessageReceive(Message* message) { // Create a randomized MessageInfo struct. MessageInfo info; eventfd_t wakeup_val = 0; info.pid = _fdp->ConsumeIntegral<int>(); info.tid = _fdp->ConsumeIntegral<int>(); info.cid = _fdp->ConsumeIntegral<int>(); info.mid = _fdp->ConsumeIntegral<int>(); info.euid = _fdp->ConsumeIntegral<int>(); info.egid = _fdp->ConsumeIntegral<int>(); info.op = _fdp->ConsumeIntegral<int32_t>(); info.flags = _fdp->ConsumeIntegral<uint32_t>(); info.service = _service; info.channel = _channel.get(); info.send_len = _fdp->ConsumeIntegral<size_t>(); info.recv_len = _fdp->ConsumeIntegral<size_t>(); info.fd_count = _fdp->ConsumeIntegral<size_t>(); if (_fdp->remaining_bytes() >= 32) { std::vector<uint8_t> impulse_vec = _fdp->ConsumeBytes<uint8_t>(32); memcpy(info.impulse, impulse_vec.data(), 32); } *message = Message(info); eventfd_read(_epoll_fd, &wakeup_val); return Status<void>(); } // Returns a tag that uniquely identifies a specific underlying IPC // transport. uint32_t GetIpcTag() const { return 0; } // Close a channel, signaling the client file object and freeing the channel // id. Once closed, the client side of the channel always returns the error // ESHUTDOWN and signals the poll/epoll events POLLHUP and POLLFREE. Status<void> CloseChannel(int channel_id) { UNUSED(channel_id); return Status<void>(); } // Update the event bits for the given channel (given by id), using the // given clear and set masks. Status<void> ModifyChannelEvents(int channel_id, int clear_mask, int set_mask) { UNUSED(channel_id); UNUSED(clear_mask); UNUSED(set_mask); return Status<void>(); } // Create a new channel and push it as a file descriptor to the process // sending the |message|. |flags| may be set to O_NONBLOCK and/or // O_CLOEXEC to control the initial behavior of the new file descriptor (the // sending process may change these later using fcntl()). The internal // Channel instance associated with this channel is set to |channel|, // which may be nullptr. The new channel id allocated for this channel is // returned in |channel_id|, which may also be nullptr if not needed. Status<RemoteChannelHandle> PushChannel(Message* message, int flags, Channel* channel, int* channel_id) { UNUSED(message); UNUSED(flags); UNUSED(channel); UNUSED(channel_id); return Status<RemoteChannelHandle>(); } // Check whether the |ref| is a reference to a channel to the service // represented by the |endpoint|. If the channel reference in question is // valid, the Channel object is returned in |channel| when non-nullptr and // the channel ID is returned through the Status object. Status<int> CheckChannel(const Message* message, ChannelReference ref, Channel** channel) { UNUSED(message); UNUSED(ref); UNUSED(channel); return Status<int>(); } // Replies to the message with a return code. Status<void> MessageReply(Message* message, int return_code) { UNUSED(message); UNUSED(return_code); return Status<void>(); } // Replies to the message with a file descriptor. Status<void> MessageReplyFd(Message* message, unsigned int push_fd) { UNUSED(message); UNUSED(push_fd); return Status<void>(); } // Replies to the message with a local channel handle. Status<void> MessageReplyChannelHandle(Message* message, const LocalChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<void>(); } // Replies to the message with a borrowed local channel handle. Status<void> MessageReplyChannelHandle(Message* message, const BorrowedChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<void>(); } // Replies to the message with a remote channel handle. Status<void> MessageReplyChannelHandle(Message* message, const RemoteChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<void>(); } // Reads message data into an array of memory buffers. Status<size_t> ReadMessageData(Message* message, const iovec* vector, size_t vector_length) { UNUSED(message); UNUSED(vector); UNUSED(vector_length); return Status<size_t>(); } // Sends reply data for message. Status<size_t> WriteMessageData(Message* message, const iovec* vector, size_t vector_length) { UNUSED(message); UNUSED(vector); UNUSED(vector_length); return Status<size_t>(); } // Records a file descriptor into the message buffer and returns the // remapped reference to be sent to the remote process. Status<FileReference> PushFileHandle(Message* message, const LocalHandle& handle) { UNUSED(message); UNUSED(handle); return Status<FileReference>(); } Status<FileReference> PushFileHandle(Message* message, const BorrowedHandle& handle) { UNUSED(message); UNUSED(handle); return Status<FileReference>(); } Status<FileReference> PushFileHandle(Message* message, const RemoteHandle& handle) { UNUSED(message); UNUSED(handle); return Status<FileReference>(); } Status<ChannelReference> PushChannelHandle(Message* message, const LocalChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<ChannelReference>(); } Status<ChannelReference> PushChannelHandle( Message* message, const BorrowedChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<ChannelReference>(); } Status<ChannelReference> PushChannelHandle( Message* message, const RemoteChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<ChannelReference>(); } // Obtains a file descriptor/channel handle from a message for the given // reference. LocalHandle GetFileHandle(Message* message, FileReference ref) const { UNUSED(message); UNUSED(ref); return LocalHandle(); } LocalChannelHandle GetChannelHandle(Message* message, ChannelReference ref) const { UNUSED(message); UNUSED(ref); return LocalChannelHandle(); } // Transport-specific message state management. void* AllocateMessageState() { return nullptr; } void FreeMessageState(void* state) { UNUSED(state); } // Cancels the endpoint, unblocking any receiver threads waiting for a // message. Status<void> Cancel() { return Status<void>(); } private: FuzzedDataProvider* _fdp; std::shared_ptr<Channel> _channel; Service* _service; int _epoll_fd; }; #endif // LEV_FUZZERS_LIBPDX_HELPERS_H_ libs/vr/libpdx/fuzz/service_dispatcher_fuzzer.cpp 0 → 100644 +74 −0 Original line number Diff line number Diff line /* * Copyright 2020 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ // Authors: corbin.souffrant@leviathansecurity.com // brian.balling@leviathansecurity.com #include <fuzzer/FuzzedDataProvider.h> #include <helpers.h> #include <pdx/client_channel.h> #include <pdx/service.h> #include <pdx/service_dispatcher.h> #include <stddef.h> #include <stdint.h> #include <sys/eventfd.h> #include <thread> using namespace android::pdx; // Dispatch fuzzer entry point. This fuzzer creates a ServiceDispatcher // and creates an endpoint that returns fuzzed messages that are passed // to the ReceiveAndDispatch and DispatchLoop functions. extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { eventfd_t wakeup_val = 1; FuzzedDataProvider fdp = FuzzedDataProvider(data, size); // Endpoint is only used to be immediately wrapped as a unique_ptr, // so it is ok to be using a raw ptr and new here without freeing. FuzzEndpoint* endpoint = new FuzzEndpoint(&fdp); std::unique_ptr<ServiceDispatcher> dispatcher = ServiceDispatcher::Create(); std::shared_ptr<Channel> channel(nullptr); std::shared_ptr<Client> client(nullptr); std::shared_ptr<Service> service( new Service("FuzzService", std::unique_ptr<Endpoint>(endpoint))); service->SetChannel(0, std::shared_ptr<Channel>(channel)); dispatcher->AddService(service); // Dispatcher blocks, so needs to run in its own thread. std::thread run_dispatcher([&]() { uint8_t opt = 0; // Right now the only operations block, so the while loop is pointless // but leaving it in, just in case that ever changes. while (fdp.remaining_bytes() > sizeof(MessageInfo)) { opt = fdp.ConsumeIntegral<uint8_t>() % dispatcher_operations.size(); dispatcher_operations[opt](dispatcher, &fdp); } }); // Continuously wake up the epoll so the dispatcher can run. while (fdp.remaining_bytes() > sizeof(MessageInfo)) { eventfd_write(endpoint->epoll_fd(), wakeup_val); } // Cleanup the dispatcher and thread. dispatcher->SetCanceled(true); if (run_dispatcher.joinable()) run_dispatcher.join(); dispatcher->RemoveService(service); return 0; } Loading
libs/vr/libpdx/fuzz/Android.bp 0 → 100644 +19 −0 Original line number Diff line number Diff line cc_fuzz { name: "libpdx_fuzz", clang: true, srcs: [ "service_dispatcher_fuzzer.cpp", ], cflags: [ "-Wall", "-Wextra", "-Werror", ], static_libs: [ "libpdx", ], shared_libs: [ "libutils", "liblog", ], }
libs/vr/libpdx/fuzz/helpers.h 0 → 100644 +294 −0 Original line number Diff line number Diff line /* * Copyright 2020 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ // Authors: corbin.souffrant@leviathansecurity.com // brian.balling@leviathansecurity.com #ifndef LEV_FUZZERS_LIBPDX_HELPERS_H_ #define LEV_FUZZERS_LIBPDX_HELPERS_H_ #define UNUSED(expr) \ do { \ (void)(expr); \ } while (0) #include <fuzzer/FuzzedDataProvider.h> #include <pdx/client.h> #include <pdx/service.h> #include <pdx/service_dispatcher.h> #include <pdx/service_endpoint.h> #include <sys/eventfd.h> #include <memory> #include <vector> using namespace android::pdx; // Vector of operations we can call in the dispatcher. static const std::vector<std::function<void( const std::unique_ptr<ServiceDispatcher>&, FuzzedDataProvider*)>> dispatcher_operations = { [](const std::unique_ptr<ServiceDispatcher>& dispatcher, FuzzedDataProvider*) -> void { dispatcher->EnterDispatchLoop(); }, [](const std::unique_ptr<ServiceDispatcher>& dispatcher, FuzzedDataProvider*) -> void { dispatcher->ReceiveAndDispatch(); }, [](const std::unique_ptr<ServiceDispatcher>& dispatcher, FuzzedDataProvider* fdp) -> void { dispatcher->ReceiveAndDispatch(fdp->ConsumeIntegral<int>()); }}; // Most of the fuzzing occurs within the endpoint, which is derived from an // abstract class. So we are returning garbage data for most functions besides // the ones we added or need to actually use. class FuzzEndpoint : public Endpoint { public: explicit FuzzEndpoint(FuzzedDataProvider* fdp) { _fdp = fdp; _epoll_fd = eventfd(0, 0); } ~FuzzEndpoint() { close(_epoll_fd); } // Returns an fd that can be used with epoll() to wait for incoming messages // from this endpoint. int epoll_fd() const { return _epoll_fd; } // Associates a Service instance with an endpoint by setting the service // context pointer to the address of the Service. Only one Service may be // associated with a given endpoint. Status<void> SetService(Service* service) { _service = service; return Status<void>(0); } // Set the channel context for the given channel. Status<void> SetChannel(int channel_id, Channel* channel) { UNUSED(channel_id); _channel = std::shared_ptr<Channel>(channel); return Status<void>(0); } // Receives a message on the given endpoint file descriptor. // This is called by the dispatcher to determine what operations // to make, so we are fuzzing the response. Status<void> MessageReceive(Message* message) { // Create a randomized MessageInfo struct. MessageInfo info; eventfd_t wakeup_val = 0; info.pid = _fdp->ConsumeIntegral<int>(); info.tid = _fdp->ConsumeIntegral<int>(); info.cid = _fdp->ConsumeIntegral<int>(); info.mid = _fdp->ConsumeIntegral<int>(); info.euid = _fdp->ConsumeIntegral<int>(); info.egid = _fdp->ConsumeIntegral<int>(); info.op = _fdp->ConsumeIntegral<int32_t>(); info.flags = _fdp->ConsumeIntegral<uint32_t>(); info.service = _service; info.channel = _channel.get(); info.send_len = _fdp->ConsumeIntegral<size_t>(); info.recv_len = _fdp->ConsumeIntegral<size_t>(); info.fd_count = _fdp->ConsumeIntegral<size_t>(); if (_fdp->remaining_bytes() >= 32) { std::vector<uint8_t> impulse_vec = _fdp->ConsumeBytes<uint8_t>(32); memcpy(info.impulse, impulse_vec.data(), 32); } *message = Message(info); eventfd_read(_epoll_fd, &wakeup_val); return Status<void>(); } // Returns a tag that uniquely identifies a specific underlying IPC // transport. uint32_t GetIpcTag() const { return 0; } // Close a channel, signaling the client file object and freeing the channel // id. Once closed, the client side of the channel always returns the error // ESHUTDOWN and signals the poll/epoll events POLLHUP and POLLFREE. Status<void> CloseChannel(int channel_id) { UNUSED(channel_id); return Status<void>(); } // Update the event bits for the given channel (given by id), using the // given clear and set masks. Status<void> ModifyChannelEvents(int channel_id, int clear_mask, int set_mask) { UNUSED(channel_id); UNUSED(clear_mask); UNUSED(set_mask); return Status<void>(); } // Create a new channel and push it as a file descriptor to the process // sending the |message|. |flags| may be set to O_NONBLOCK and/or // O_CLOEXEC to control the initial behavior of the new file descriptor (the // sending process may change these later using fcntl()). The internal // Channel instance associated with this channel is set to |channel|, // which may be nullptr. The new channel id allocated for this channel is // returned in |channel_id|, which may also be nullptr if not needed. Status<RemoteChannelHandle> PushChannel(Message* message, int flags, Channel* channel, int* channel_id) { UNUSED(message); UNUSED(flags); UNUSED(channel); UNUSED(channel_id); return Status<RemoteChannelHandle>(); } // Check whether the |ref| is a reference to a channel to the service // represented by the |endpoint|. If the channel reference in question is // valid, the Channel object is returned in |channel| when non-nullptr and // the channel ID is returned through the Status object. Status<int> CheckChannel(const Message* message, ChannelReference ref, Channel** channel) { UNUSED(message); UNUSED(ref); UNUSED(channel); return Status<int>(); } // Replies to the message with a return code. Status<void> MessageReply(Message* message, int return_code) { UNUSED(message); UNUSED(return_code); return Status<void>(); } // Replies to the message with a file descriptor. Status<void> MessageReplyFd(Message* message, unsigned int push_fd) { UNUSED(message); UNUSED(push_fd); return Status<void>(); } // Replies to the message with a local channel handle. Status<void> MessageReplyChannelHandle(Message* message, const LocalChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<void>(); } // Replies to the message with a borrowed local channel handle. Status<void> MessageReplyChannelHandle(Message* message, const BorrowedChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<void>(); } // Replies to the message with a remote channel handle. Status<void> MessageReplyChannelHandle(Message* message, const RemoteChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<void>(); } // Reads message data into an array of memory buffers. Status<size_t> ReadMessageData(Message* message, const iovec* vector, size_t vector_length) { UNUSED(message); UNUSED(vector); UNUSED(vector_length); return Status<size_t>(); } // Sends reply data for message. Status<size_t> WriteMessageData(Message* message, const iovec* vector, size_t vector_length) { UNUSED(message); UNUSED(vector); UNUSED(vector_length); return Status<size_t>(); } // Records a file descriptor into the message buffer and returns the // remapped reference to be sent to the remote process. Status<FileReference> PushFileHandle(Message* message, const LocalHandle& handle) { UNUSED(message); UNUSED(handle); return Status<FileReference>(); } Status<FileReference> PushFileHandle(Message* message, const BorrowedHandle& handle) { UNUSED(message); UNUSED(handle); return Status<FileReference>(); } Status<FileReference> PushFileHandle(Message* message, const RemoteHandle& handle) { UNUSED(message); UNUSED(handle); return Status<FileReference>(); } Status<ChannelReference> PushChannelHandle(Message* message, const LocalChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<ChannelReference>(); } Status<ChannelReference> PushChannelHandle( Message* message, const BorrowedChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<ChannelReference>(); } Status<ChannelReference> PushChannelHandle( Message* message, const RemoteChannelHandle& handle) { UNUSED(message); UNUSED(handle); return Status<ChannelReference>(); } // Obtains a file descriptor/channel handle from a message for the given // reference. LocalHandle GetFileHandle(Message* message, FileReference ref) const { UNUSED(message); UNUSED(ref); return LocalHandle(); } LocalChannelHandle GetChannelHandle(Message* message, ChannelReference ref) const { UNUSED(message); UNUSED(ref); return LocalChannelHandle(); } // Transport-specific message state management. void* AllocateMessageState() { return nullptr; } void FreeMessageState(void* state) { UNUSED(state); } // Cancels the endpoint, unblocking any receiver threads waiting for a // message. Status<void> Cancel() { return Status<void>(); } private: FuzzedDataProvider* _fdp; std::shared_ptr<Channel> _channel; Service* _service; int _epoll_fd; }; #endif // LEV_FUZZERS_LIBPDX_HELPERS_H_
libs/vr/libpdx/fuzz/service_dispatcher_fuzzer.cpp 0 → 100644 +74 −0 Original line number Diff line number Diff line /* * Copyright 2020 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ // Authors: corbin.souffrant@leviathansecurity.com // brian.balling@leviathansecurity.com #include <fuzzer/FuzzedDataProvider.h> #include <helpers.h> #include <pdx/client_channel.h> #include <pdx/service.h> #include <pdx/service_dispatcher.h> #include <stddef.h> #include <stdint.h> #include <sys/eventfd.h> #include <thread> using namespace android::pdx; // Dispatch fuzzer entry point. This fuzzer creates a ServiceDispatcher // and creates an endpoint that returns fuzzed messages that are passed // to the ReceiveAndDispatch and DispatchLoop functions. extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { eventfd_t wakeup_val = 1; FuzzedDataProvider fdp = FuzzedDataProvider(data, size); // Endpoint is only used to be immediately wrapped as a unique_ptr, // so it is ok to be using a raw ptr and new here without freeing. FuzzEndpoint* endpoint = new FuzzEndpoint(&fdp); std::unique_ptr<ServiceDispatcher> dispatcher = ServiceDispatcher::Create(); std::shared_ptr<Channel> channel(nullptr); std::shared_ptr<Client> client(nullptr); std::shared_ptr<Service> service( new Service("FuzzService", std::unique_ptr<Endpoint>(endpoint))); service->SetChannel(0, std::shared_ptr<Channel>(channel)); dispatcher->AddService(service); // Dispatcher blocks, so needs to run in its own thread. std::thread run_dispatcher([&]() { uint8_t opt = 0; // Right now the only operations block, so the while loop is pointless // but leaving it in, just in case that ever changes. while (fdp.remaining_bytes() > sizeof(MessageInfo)) { opt = fdp.ConsumeIntegral<uint8_t>() % dispatcher_operations.size(); dispatcher_operations[opt](dispatcher, &fdp); } }); // Continuously wake up the epoll so the dispatcher can run. while (fdp.remaining_bytes() > sizeof(MessageInfo)) { eventfd_write(endpoint->epoll_fd(), wakeup_val); } // Cleanup the dispatcher and thread. dispatcher->SetCanceled(true); if (run_dispatcher.joinable()) run_dispatcher.join(); dispatcher->RemoveService(service); return 0; }
