Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 28c906b0 authored by Zach Johnson's avatar Zach Johnson
Browse files

Add very basic AclManager fuzz test 

Right now, only sends ACL up.
Also, turn off LOG_WARN in fuzzing, to cut down on log spam.

Test: fuzz/run --host bluetooth_gd_acl_manager_fuzz_test
Change-Id: Ifca979dbc36b5bd62dc07e6cfda644077c766f17
parent ae1f6c41

system/gd/Android.bp

+8 −0
Original line number Diff line number Diff line
@@ -365,6 +365,14 @@ cc_fuzz { 
    ],

}



cc_fuzz {

    name: "bluetooth_gd_acl_manager_fuzz_test",

    defaults: ["gd_fuzz_defaults"],

    srcs: [

        "hci/fuzz/acl_manager_fuzz_test.cc",

    ],

}



cc_benchmark {

    name: "bluetooth_benchmark_gd",

    defaults: ["gd_defaults"],

system/gd/hci/Android.bp

+1 −0
Original line number Diff line number Diff line
@@ -58,6 +58,7 @@ filegroup { 
    srcs: [

        "fuzz/status_vs_complete_commands.cc",

        "fuzz/hci_layer_fuzz_client.cc",

        "fuzz/fuzz_hci_layer.cc",

    ],

}

system/gd/hci/fuzz/acl_manager_fuzz_test.cc

0 → 100644
+66 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2019 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <stddef.h>

#include <stdint.h>

#include "fuzz/helpers.h"

#include "hci/acl_manager.h"

#include "hci/fuzz/fuzz_hci_layer.h"

#include "hci/hci_layer.h"

#include "module.h"

#include "os/fuzz/fake_timerfd.h"

#include "os/log.h"



#include <fuzzer/FuzzedDataProvider.h>



using bluetooth::TestModuleRegistry;

using bluetooth::fuzz::GetArbitraryBytes;

using bluetooth::hci::AclManager;

using bluetooth::hci::HciLayer;

using bluetooth::hci::fuzz::FuzzHciLayer;

using bluetooth::os::fuzz::fake_timerfd_advance;

using bluetooth::os::fuzz::fake_timerfd_cap_at;

using bluetooth::os::fuzz::fake_timerfd_reset;



extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

  FuzzedDataProvider dataProvider(data, size);



  static TestModuleRegistry moduleRegistry = TestModuleRegistry();

  FuzzHciLayer* fuzzHci = new FuzzHciLayer();



  moduleRegistry.InjectTestModule(&HciLayer::Factory, fuzzHci);

  fuzzHci->Start();

  moduleRegistry.Start<AclManager>(&moduleRegistry.GetTestThread());



  while (dataProvider.remaining_bytes() > 0) {

    const uint8_t action = dataProvider.ConsumeIntegralInRange(0, 12);

    switch (action) {

      case 1:

        fake_timerfd_advance(dataProvider.ConsumeIntegral<uint64_t>());

        break;

      case 2:

        fuzzHci->injectAclData(GetArbitraryBytes(&dataProvider));

        break;

    }

  }



  if (!moduleRegistry.GetTestThread().GetReactor()->WaitForIdle(std::chrono::milliseconds(100))) {

    LOG_ERROR("idle timed out");

  }

  moduleRegistry.StopAll();

  fake_timerfd_reset();

  return 0;

}

system/gd/hci/fuzz/fuzz_hci_layer.cc

0 → 100644
+82 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2020 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include "hci/fuzz/fuzz_hci_layer.h"



namespace bluetooth {

namespace hci {

namespace fuzz {



common::BidiQueueEnd<hci::AclPacketBuilder, hci::AclPacketView>* FuzzHciLayer::GetAclQueueEnd() {

  return acl_queue_.GetUpEnd();

}



hci::SecurityInterface* FuzzHciLayer::GetSecurityInterface(common::Callback<void(hci::EventPacketView)> event_handler,

                                                           os::Handler* handler) {

  return &security_interface_;

}



hci::LeSecurityInterface* FuzzHciLayer::GetLeSecurityInterface(

    common::Callback<void(hci::LeMetaEventView)> event_handler, os::Handler* handler) {

  return &le_security_interface_;

}



hci::AclConnectionInterface* FuzzHciLayer::GetAclConnectionInterface(

    common::Callback<void(hci::EventPacketView)> event_handler,

    common::Callback<void(uint16_t, hci::ErrorCode)> on_disconnect, os::Handler* handler) {

  return &acl_connection_interface_;

}



hci::LeAclConnectionInterface* FuzzHciLayer::GetLeAclConnectionInterface(

    common::Callback<void(hci::LeMetaEventView)> event_handler,

    common::Callback<void(uint16_t, hci::ErrorCode)> on_disconnect, os::Handler* handler) {

  return &le_acl_connection_interface_;

}



hci::LeAdvertisingInterface* FuzzHciLayer::GetLeAdvertisingInterface(

    common::Callback<void(hci::LeMetaEventView)> event_handler, os::Handler* handler) {

  return &le_advertising_interface_;

}



hci::LeScanningInterface* FuzzHciLayer::GetLeScanningInterface(

    common::Callback<void(hci::LeMetaEventView)> event_handler, os::Handler* handler) {

  return &le_scanning_interface_;

}



void FuzzHciLayer::Start() {

  acl_dev_null_ = new os::fuzz::DevNullQueue<AclPacketBuilder>(acl_queue_.GetDownEnd(), GetHandler());

  acl_dev_null_->Start();

  acl_inject_ = new os::fuzz::FuzzInjectQueue<AclPacketView>(acl_queue_.GetDownEnd(), GetHandler());

}



void FuzzHciLayer::Stop() {

  acl_dev_null_->Stop();

  delete acl_dev_null_;

  delete acl_inject_;

}



void FuzzHciLayer::injectAclData(std::vector<uint8_t> data) {

  hci::AclPacketView aclPacket = hci::AclPacketView::FromBytes(data);

  if (!aclPacket.IsValid()) {

    return;

  }



  acl_inject_->Inject(std::make_unique<AclPacketView>(aclPacket));

}



}  // namespace fuzz

}  // namespace hci

}  // namespace bluetooth

system/gd/hci/fuzz/fuzz_hci_layer.h

0 → 100644
+105 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2020 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#pragma once



#include "hci/command_interface.h"

#include "hci/hci_layer.h"

#include "os/fuzz/dev_null_queue.h"

#include "os/fuzz/fuzz_inject_queue.h"



namespace bluetooth {

namespace hci {

namespace fuzz {



template <typename T>

class FuzzCommandInterface : public CommandInterface<T> {

 public:

  void EnqueueCommand(std::unique_ptr<T> command, common::OnceCallback<void(hci::CommandCompleteView)> on_complete,

                      os::Handler* handler) override {}



  void EnqueueCommand(std::unique_ptr<T> command, common::OnceCallback<void(hci::CommandStatusView)> on_status,

                      os::Handler* handler) override {}

};



class FuzzHciLayer : public HciLayer {

 public:

  void EnqueueCommand(std::unique_ptr<hci::CommandPacketBuilder> command,

                      common::OnceCallback<void(hci::CommandCompleteView)> on_complete, os::Handler* handler) override {

  }



  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,

                      common::OnceCallback<void(hci::CommandStatusView)> on_status, os::Handler* handler) override {}



  common::BidiQueueEnd<hci::AclPacketBuilder, hci::AclPacketView>* GetAclQueueEnd() override;



  void RegisterEventHandler(hci::EventCode event_code, common::Callback<void(hci::EventPacketView)> event_handler,

                            os::Handler* handler) override {}



  void UnregisterEventHandler(hci::EventCode event_code) override {}



  void RegisterLeEventHandler(hci::SubeventCode subevent_code,

                              common::Callback<void(hci::LeMetaEventView)> event_handler,

                              os::Handler* handler) override {}



  void UnregisterLeEventHandler(hci::SubeventCode subevent_code) override {}



  hci::SecurityInterface* GetSecurityInterface(common::Callback<void(hci::EventPacketView)> event_handler,

                                               os::Handler* handler) override;



  hci::LeSecurityInterface* GetLeSecurityInterface(common::Callback<void(hci::LeMetaEventView)> event_handler,

                                                   os::Handler* handler) override;



  hci::AclConnectionInterface* GetAclConnectionInterface(common::Callback<void(hci::EventPacketView)> event_handler,

                                                         common::Callback<void(uint16_t, hci::ErrorCode)> on_disconnect,

                                                         os::Handler* handler) override;



  hci::LeAclConnectionInterface* GetLeAclConnectionInterface(

      common::Callback<void(hci::LeMetaEventView)> event_handler,

      common::Callback<void(uint16_t, hci::ErrorCode)> on_disconnect, os::Handler* handler) override;



  hci::LeAdvertisingInterface* GetLeAdvertisingInterface(common::Callback<void(hci::LeMetaEventView)> event_handler,

                                                         os::Handler* handler) override;



  hci::LeScanningInterface* GetLeScanningInterface(common::Callback<void(hci::LeMetaEventView)> event_handler,

                                                   os::Handler* handler) override;



  void injectAclData(std::vector<uint8_t> data);



  std::string ToString() const override {

    return "FuzzHciLayer";

  }



  void ListDependencies(ModuleList* list) override {}

  void Start() override;

  void Stop() override;



 private:

  common::BidiQueue<hci::AclPacketView, hci::AclPacketBuilder> acl_queue_{3};

  os::fuzz::DevNullQueue<AclPacketBuilder>* acl_dev_null_;

  os::fuzz::FuzzInjectQueue<AclPacketView>* acl_inject_;



  FuzzCommandInterface<ConnectionManagementCommandBuilder> acl_connection_interface_{};

  FuzzCommandInterface<LeConnectionManagementCommandBuilder> le_acl_connection_interface_{};

  FuzzCommandInterface<SecurityCommandBuilder> security_interface_{};

  FuzzCommandInterface<LeSecurityCommandBuilder> le_security_interface_{};

  FuzzCommandInterface<LeAdvertisingCommandBuilder> le_advertising_interface_{};

  FuzzCommandInterface<LeScanningCommandBuilder> le_scanning_interface_{};

};



}  // namespace fuzz

}  // namespace hci

}  // namespace bluetooth