Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 300a944e authored by Alec Mouri's avatar Alec Mouri
Browse files

Delete (most) sf fuzzers 

The remaining fuzzer works at the AIDL service level, which is under development + evaluation.

The rest of the fuzzers don't operate at the right interface to meaningfully catch security issues, and are a maintenance cost.

Bug: 325656219
Change-Id: I7ec9b41ff561ab3f0e7d48a93a9b6bb57caffe50
Test: builds
parent 74962b78

services/surfaceflinger/fuzzer/Android.bp

+0 −88
Original line number Diff line number Diff line
@@ -26,46 +26,18 @@ package { 


cc_defaults {

    name: "surfaceflinger_fuzz_defaults",

    include_dirs: [

        "frameworks/native/services/surfaceflinger/tests/unittests",

    ],

    static_libs: [

        "android.hardware.graphics.composer@2.1-resources",

        "libc++fs",

        "libgmock",

        "libgui_mocks",

        "libgmock_ndk",

        "libgmock_main",

        "libgtest_ndk_c++",

        "libgmock_main_ndk",

        "librenderengine_mocks",

        "libsurfaceflinger_common",

        "perfetto_trace_protos",

        "libcompositionengine_mocks",

        "perfetto_trace_protos",

    ],

    shared_libs: [

        "libprotoutil",

        "libstatssocket",

        "libstatspull",

        "libtimestats",

        "libtimestats_proto",

        "libprotobuf-cpp-full",

        "android.hardware.graphics.mapper@2.0",

        "android.hardware.graphics.mapper@3.0",

        "android.hardware.graphics.mapper@4.0",

    ],

    srcs: [

        ":libsurfaceflinger_sources",

        ":libsurfaceflinger_mock_sources",

    ],

    defaults: [

        "libsurfaceflinger_defaults",

    ],

    header_libs: [

        "libui_fuzzableDataspaces_headers",

        "libsurfaceflinger_headers",

        "libui_headers",

    ],

    cflags: [

        "-Wno-unused-result",
@@ -89,66 +61,6 @@ cc_defaults { 
    },

}



cc_fuzz {

    name: "surfaceflinger_fuzzer",

    defaults: [

        "surfaceflinger_fuzz_defaults",

    ],

    srcs: [

        "surfaceflinger_fuzzer.cpp",

    ],

}



cc_fuzz {

    name: "surfaceflinger_displayhardware_fuzzer",

    defaults: [

        "surfaceflinger_fuzz_defaults",

    ],

    srcs: [

        "surfaceflinger_displayhardware_fuzzer.cpp",

    ],

    header_libs: [

        "android.hardware.graphics.composer@2.4-command-buffer",

        "android.hardware.graphics.composer@2.4-hal",

    ],

}



cc_fuzz {

    name: "surfaceflinger_scheduler_fuzzer",

    defaults: [

        "surfaceflinger_fuzz_defaults",

    ],

    srcs: [

        "surfaceflinger_scheduler_fuzzer.cpp",

    ],

}



cc_fuzz {

    name: "surfaceflinger_layer_fuzzer",

    defaults: [

        "surfaceflinger_fuzz_defaults",

    ],

    header_libs: [

        "libgui_headers",

    ],

    static_libs: [

        "librenderengine",

    ],

    srcs: [

        "surfaceflinger_layer_fuzzer.cpp",

    ],

}



cc_fuzz {

    name: "surfaceflinger_frametracer_fuzzer",

    defaults: [

        "surfaceflinger_fuzz_defaults",

    ],

    srcs: [

        "surfaceflinger_frametracer_fuzzer.cpp",

    ],

}



cc_fuzz {

    name: "surfaceflinger_service_fuzzer",

    defaults: [

services/surfaceflinger/fuzzer/README.md

deleted100644 → 0
+0 −108
Original line number Diff line number Diff line 
# Fuzzers for SurfaceFlinger

## Table of contents

+ [SurfaceFlinger](#SurfaceFlinger)

+ [DisplayHardware](#DisplayHardware)

+ [Scheduler](#Scheduler)

+ [Layer](#Layer)

+ [FrameTracer](#FrameTracer)



# <a name="SurfaceFlinger"></a> Fuzzer for SurfaceFlinger



SurfaceFlinger supports the following data sources:

1. Pixel Formats (parameter name: `defaultCompositionPixelFormat`)

2. Data Spaces (parameter name: `defaultCompositionDataspace`)

3. Rotations (parameter name: `internalDisplayOrientation`)

3. Surface composer tags (parameter name: `onTransact`)



You can find the possible values in the fuzzer's source code.



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) surfaceflinger_fuzzer

```

2. To run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/surfaceflinger_fuzzer/surfaceflinger_fuzzer

```



# <a name="DisplayHardware"></a> Fuzzer for DisplayHardware



DisplayHardware supports the following parameters:

1. Hal Capability (parameter name: `hasCapability`)

2. Hal BlendMode (parameter name: `setBlendMode`)

3. Hal Composition (parameter name: `setCompositionType`)

4. Hal Display Capability (parameter name: `hasDisplayCapability`)

5. Composition Types (parameter name: `prepareFrame`)

6. Color Modes (parameter name: `setActiveColorMode`)

7. Render Intents (parameter name: `setActiveColorMode`)

8. Power Modes (parameter name: `setPowerMode`)

9. Content Types (parameter name: `setContentType`)

10. Data Space (parameter name: `setDataspace`)

11. Transforms (parameter name: `setLayerTransform`)



You can find the possible values in the fuzzer's source code.



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) surfaceflinger_displayhardware_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/surfaceflinger_displayhardware_fuzzer/surfaceflinger_displayhardware_fuzzer

```



# <a name="Scheduler"></a> Fuzzer for Scheduler



Scheduler supports the following parameters:

1. VSync Periods (parameter name: `lowFpsPeriod`)



You can find the possible values in the fuzzer's source code.



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) surfaceflinger_scheduler_fuzzer

```

2. To run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/surfaceflinger_scheduler_fuzzer/surfaceflinger_scheduler_fuzzer

```



# <a name="Layer"></a> Fuzzer for Layer



Layer supports the following parameters:

1. Display Connection Types (parameter name: `fakeDisplay`)

2. State Sets (parameter name: `traverseInZOrder`)

3. Disconnect modes (parameter name: `disconnect`)

4. Data Spaces (parameter name: `setDataspace`)



You can find the possible values in the fuzzer's source code.



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) surfaceflinger_layer_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/surfaceflinger_layer_fuzzer/surfaceflinger_layer_fuzzer

```



# <a name="FrameTracer"></a> Fuzzer for FrameTracer



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) surfaceflinger_frametracer_fuzzer

```

2. To run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/surfaceflinger_frametracer_fuzzer/surfaceflinger_frametracer_fuzzer

```