Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a9d8924a authored by Zach Johnson's avatar Zach Johnson
Browse files

Add fake_timerfd_cap_at to allow tests to prevent error conditions 

e.g. we don't want to trigger a command timeout from fuzz tests

Test: fuzz/run --host bluetooth_gd_hci_fuzz_test
Change-Id: Ic98d029e13fee8dcf102e490a8033d1636079f4b
parent 5330e0e9

system/gd/hci/fuzz/hci_layer_fuzz_test.cc

+2 −0
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@ using bluetooth::hal::HciHal; 
using bluetooth::hal::fuzz::FuzzHciHal;

using bluetooth::hci::fuzz::DevNullHci;

using bluetooth::os::fuzz::fake_timerfd_advance;

using bluetooth::os::fuzz::fake_timerfd_cap_at;

using bluetooth::os::fuzz::fake_timerfd_reset;



static std::vector<uint8_t> GetArbitraryBytes(FuzzedDataProvider* fdp) {
@@ -38,6 +39,7 @@ static std::vector<uint8_t> GetArbitraryBytes(FuzzedDataProvider* fdp) { 


extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

  FuzzedDataProvider dataProvider(data, size);

  fake_timerfd_cap_at(1999);  // prevent command timeouts



  static TestModuleRegistry moduleRegistry = TestModuleRegistry();

  FuzzHciHal* fuzzHal = new FuzzHciHal();

system/gd/os/fuzz/fake_timerfd.cc

+9 −0
Original line number Diff line number Diff line
@@ -33,6 +33,7 @@ class FakeTimerFd { 


static std::map<int, FakeTimerFd*> fake_timers;

static uint64_t clock = 0;

static uint64_t max_clock = UINT64_MAX;



static uint64_t timespec_to_ms(const timespec* t) {

  return t->tv_sec * 1000 + t->tv_nsec / 1000000;
@@ -80,6 +81,7 @@ int fake_timerfd_close(int fd) { 


void fake_timerfd_reset() {

  clock = 0;

  max_clock = UINT64_MAX;

  // if there are entries still here, it is a failure of our users to clean up

  // so let them leak and trigger errors

  fake_timers.clear();
@@ -118,11 +120,18 @@ static bool fire_next_event(uint64_t new_clock) { 


void fake_timerfd_advance(uint64_t ms) {

  uint64_t new_clock = clock + ms;

  if (new_clock > max_clock) {

    new_clock = max_clock;

  }

  while (fire_next_event(new_clock)) {

  }

  clock = new_clock;

}



void fake_timerfd_cap_at(uint64_t ms) {

  max_clock = ms;

}



}  // namespace fuzz

}  // namespace os

}  // namespace bluetooth

system/gd/os/fuzz/fake_timerfd.h

+2 −0
Original line number Diff line number Diff line
@@ -33,6 +33,8 @@ void fake_timerfd_reset(); 


void fake_timerfd_advance(uint64_t ms);



void fake_timerfd_cap_at(uint64_t ms);



}  // namespace fuzz

}  // namespace os

}  // namespace bluetooth