Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aa36cb13 authored by Zhanglong Xia's avatar Zhanglong Xia Committed by Kangping Dong
Browse files

add fuzz test and fix the Thread network HAL compile errors 

Bug: 288825495
Test: Build and run fuzz test in cuttlefish
(cherry picked from https://android-review.googlesource.com/q/commit:5c027015c3437ecf54e9a8dc4eb8a7b4b3ec542b)
Merged-In: If14bd95657d6a71737a348ccbc6d1b05bbcc1f4c
Change-Id: If14bd95657d6a71737a348ccbc6d1b05bbcc1f4c
parent 9fec4134

compatibility_matrices/compatibility_matrix.8.xml

+0 −8
Original line number Diff line number Diff line
@@ -717,12 +717,4 @@ 
            <regex-instance>.*</regex-instance>

        </interface>

    </hal>

    <hal format="aidl" optional="true">

        <name>android.hardware.threadnetwork</name>

        <version>1</version>

        <interface>

            <name>IThreadChip</name>

            <regex-instance>chip[0-9]+</regex-instance>

        </interface>

    </hal>

</compatibility-matrix>

compatibility_matrices/compatibility_matrix.9.xml

+8 −0
Original line number Diff line number Diff line
@@ -727,4 +727,12 @@ 
            <regex-instance>.*</regex-instance>

        </interface>

    </hal>

    <hal format="aidl" optional="true">

        <name>android.hardware.threadnetwork</name>

        <version>1</version>

        <interface>

            <name>IThreadChip</name>

            <regex-instance>chip[0-9]+</regex-instance>

        </interface>

    </hal>

</compatibility-matrix>

threadnetwork/aidl/default/Android.bp

+34 −4
Original line number Diff line number Diff line
@@ -24,10 +24,6 @@ cc_defaults { 
        "libutils",

    ],



    cppflags: [

        "-Wno-non-virtual-dtor",

    ],



    static_libs: [

        "openthread-common",

        "openthread-hdlc",
@@ -48,9 +44,43 @@ cc_binary { 
    name: "android.hardware.threadnetwork-service.sim",

    defaults: ["threadnetwork_service_default"],

    init_rc: ["android.hardware.threadnetwork-service.sim.rc"],

    required: ["ot-rcp"],

}



cc_binary {

    name: "android.hardware.threadnetwork-service",

    defaults: ["threadnetwork_service_default"],

}



cc_fuzz {

    name: "android.hardware.threadnetwork-service.fuzzer",



    defaults:["service_fuzzer_defaults"],

    shared_libs: [

        "libbinder_ndk",

    ],



    static_libs: [

        "android.hardware.threadnetwork-V1-ndk",

        "libbase",

        "liblog",

        "openthread-common",

        "openthread-hdlc",

        "openthread-platform",

        "openthread-posix",

        "openthread-url",

    ],



    srcs: [

        "thread_chip.cpp",

        "utils.cpp",

        "fuzzer.cpp",

    ],



    required: ["ot-rcp"],

    fuzz_config: {

        cc: [

            "zhanglongxia@google.com",

        ],

    },

}

threadnetwork/aidl/default/utils.hpp→threadnetwork/aidl/default/fuzzer.cpp

+16 −4
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022 The Android Open Source Project

 * Copyright (C) 2023 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.
@@ -14,7 +14,19 @@ 
 * limitations under the License.

 */



#pragma once

#include <fuzzbinder/libbinder_ndk_driver.h>

#include <fuzzer/FuzzedDataProvider.h>

#include "thread_chip.hpp"



using aidl::android::hardware::threadnetwork::ThreadChip;

using android::fuzzService;



extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

    char url[] = "spinel+hdlc+forkpty:///vendor/bin/ot-rcp?forkpty-arg=2";

    auto service = ndk::SharedRefBase::make<ThreadChip>(url);



    fuzzService(service->asBinder().get(), FuzzedDataProvider(data, size));



    return 0;

}

#define LOG_TAG "threadnetwork_hal"

#include <utils/Log.h>

threadnetwork/aidl/default/main.cpp

+25 −2
Original line number Diff line number Diff line
@@ -14,14 +14,37 @@ 
 * limitations under the License.

 */



#include <aidl/android/hardware/threadnetwork/IThreadChip.h>

#include <android-base/logging.h>

#include <android/binder_manager.h>

#include <android/binder_process.h>

#include <utils/Log.h>



#include "service.hpp"

#include "utils.hpp"

#include "thread_chip.hpp"



using aidl::android::hardware::threadnetwork::IThreadChip;

using aidl::android::hardware::threadnetwork::ThreadChip;



int main(int argc, char* argv[]) {

    CHECK_GT(argc, 1);

    aidl::android::hardware::threadnetwork::Service service(&argv[1], argc - 1);

    std::vector<std::shared_ptr<ThreadChip>> threadChips;

    aidl::android::hardware::threadnetwork::Service service;



    for (int id = 0; id < argc - 1; id++) {

        binder_status_t status;

        const std::string serviceName(std::string() + IThreadChip::descriptor + "/chip" +

                                      std::to_string(id));

        auto threadChip = ndk::SharedRefBase::make<ThreadChip>(argv[id + 1]);



        CHECK_NE(threadChip, nullptr);



        status = AServiceManager_addService(threadChip->asBinder().get(), serviceName.c_str());

        CHECK_EQ(status, STATUS_OK);



        ALOGI("ServiceName: %s, Url: %s", serviceName.c_str(), argv[id + 1]);

        threadChips.push_back(std::move(threadChip));

    }



    ALOGI("Thread Network HAL is running");