Merge "binder_parcel_fuzzer: Cause FDs to be open before tracking them" into main (124274b3) · Commits · e / os / android_frameworks_native

libs/binder/tests/parcel_fuzzer/Android.bp

+10 −9

Original line number	Diff line number	Diff line
		@@ -13,8 +13,8 @@ aidl_interface {
		unstable: true,
		srcs: [
		"parcelables/EmptyParcelable.aidl",
		"parcelables/SingleDataParcelable.aidl",
		"parcelables/GenericDataParcelable.aidl",
		"parcelables/SingleDataParcelable.aidl",
		],
		flags: [
		"-Werror",
		@@ -52,27 +52,28 @@ cc_fuzz {
		"random_parcel.cpp",
		],
		static_libs: [
		"binderReadParcelIface-cpp",
		"binderReadParcelIface-ndk",
		"libbase",
		"libbinder_random_parcel",
		"libcutils",
		"libhidlbase",
		"liblog",
		"binderReadParcelIface-cpp",
		"binderReadParcelIface-ndk",
		],

		target: {
		android: {
		shared_libs: [
		"libbinder_ndk",
		"libbinder",
		"libbinder_ndk",
		"liblog",
		"libutils",
		],
		},
		host: {
		static_libs: [
		"libbinder_ndk",
		"libbinder",
		"libbinder_ndk",
		"liblog",
		"libutils",
		],
		},
		@@ -96,11 +97,11 @@ cc_library_static {
		},
		},
		srcs: [
		"libbinder_driver.cpp",
		"libbinder_ndk_driver.cpp",
		"random_binder.cpp",
		"random_fd.cpp",
		"random_parcel.cpp",
		"libbinder_driver.cpp",
		"libbinder_ndk_driver.cpp",
		],
		shared_libs: [
		"libbase",
		@@ -163,7 +164,7 @@ cc_binary_host {
		shared_libs: [
		"libbase",
		"libbinder",
		"libutils",
		"libcutils",
		"libutils",
		],
		}

+11 −0

Original line number	Diff line number	Diff line
		@@ -25,8 +25,11 @@
		#include <android-base/logging.h>
		#include <android/binder_auto_utils.h>
		#include <android/binder_libbinder.h>
		#include <binder/ProcessState.h>
		#include <binder/Trace.h>
		#include <fuzzbinder/random_parcel.h>
		#include <fuzzer/FuzzedDataProvider.h>
		#include <hwbinder/ProcessState.h>

		#include <sys/resource.h>
		#include <sys/time.h>
		@@ -40,6 +43,7 @@ using android::fillRandomParcel;
		using android::RandomParcelOptions;
		using android::sp;
		using android::HexString;
		std::once_flag gOpenFds;

		void fillRandomParcel(::android::hardware::Parcel* p, FuzzedDataProvider&& provider,
		RandomParcelOptions* options) {
		@@ -167,6 +171,13 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

		// avoid timeouts, see b/142617274, b/142473153
		if (size > 50000) return 0;
		std::call_once(gOpenFds, []() {
		// Cause the known FDs to be created before we track them.
		android::binder::ScopedTrace openYourFds(ATRACE_TAG_AIDL, "Open FDs");
		(void)android::ProcessState::self();
		(void)android::hardware::ProcessState::self();
		ALOGE("Logging creates a socked + a pmsg FD");
		});

		struct rlimit limit{};
		CHECK_EQ(0, getrlimit(RLIMIT_NOFILE, &limit));