Snap for 12903105 from afb0df1b875c8cacada81f5f824d71bfeb959045 to 25Q2-release (3f9f7ad5) · Commits · e / os / android_system_core

libstats/expresslog/Android.bp

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -51,7 +51,7 @@ cc_library {
	min_sdk_version: "33",		min_sdk_version: "33",
	apex_available: [		apex_available: [
	"//apex_available:platform",		"//apex_available:platform",
	"com.android.btservices",		"com.android.bt",
	],		],
	}		}

	@@ -85,7 +85,7 @@ cc_library_static {
	min_sdk_version: "33",		min_sdk_version: "33",
	apex_available: [		apex_available: [
	"//apex_available:platform",		"//apex_available:platform",
	"com.android.btservices",		"com.android.bt",
	],		],
	}		}

trusty/fuzz/tipc_fuzzer.cpp

+77 −18

Original line number	Original line	Diff line number	Diff line
	@@ -14,6 +14,8 @@
	* limitations under the License.		* limitations under the License.
	*/		*/

			#include <android-base/result.h>
			#include <fuzzer/FuzzedDataProvider.h>
	#include <stdlib.h>		#include <stdlib.h>
	#include <trusty/coverage/coverage.h>		#include <trusty/coverage/coverage.h>
	#include <trusty/coverage/uuid.h>		#include <trusty/coverage/uuid.h>
	@@ -23,6 +25,7 @@
	#include <iostream>		#include <iostream>
	#include <memory>		#include <memory>

			using android::base::Result;
	using android::trusty::coverage::CoverageRecord;		using android::trusty::coverage::CoverageRecord;
	using android::trusty::fuzz::ExtraCounters;		using android::trusty::fuzz::ExtraCounters;
	using android::trusty::fuzz::TrustyApp;		using android::trusty::fuzz::TrustyApp;
	@@ -41,7 +44,12 @@ using android::trusty::fuzz::TrustyApp;
	#error "Binary file name must be parameterized using -DTRUSTY_APP_FILENAME."		#error "Binary file name must be parameterized using -DTRUSTY_APP_FILENAME."
	#endif		#endif

	static TrustyApp kTrustyApp(TIPC_DEV, TRUSTY_APP_PORT);		#ifdef TRUSTY_APP_MAX_CONNECTIONS
			constexpr size_t MAX_CONNECTIONS = TRUSTY_APP_MAX_CONNECTIONS;
			#else
			constexpr size_t MAX_CONNECTIONS = 1;
			#endif

	static std::unique_ptr<CoverageRecord> record;		static std::unique_ptr<CoverageRecord> record;

	extern "C" int LLVMFuzzerInitialize(int* /* argc /, char** /* argv */) {		extern "C" int LLVMFuzzerInitialize(int* /* argc /, char** /* argv */) {
	@@ -53,7 +61,8 @@ extern "C" int LLVMFuzzerInitialize(int* /* argc /, char** /* argv */) {
	}		}

	/* Make sure lazy-loaded TAs have started and connected to coverage service. */		/* Make sure lazy-loaded TAs have started and connected to coverage service. */
	auto ret = kTrustyApp.Connect();		TrustyApp ta(TIPC_DEV, TRUSTY_APP_PORT);
			auto ret = ta.Connect();
	if (!ret.ok()) {		if (!ret.ok()) {
	std::cerr << ret.error() << std::endl;		std::cerr << ret.error() << std::endl;
	exit(-1);		exit(-1);
	@@ -73,24 +82,74 @@ extern "C" int LLVMFuzzerInitialize(int* /* argc /, char** /* argv */) {
	return 0;		return 0;
	}		}

	extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {		void abortResult(Result<void> result) {
	static uint8_t buf[TIPC_MAX_MSG_SIZE];		if (result.ok()) {
			return;
	ExtraCounters counters(record.get());		}
	counters.Reset();		std::cerr << result.error() << std::endl;
			android::trusty::fuzz::Abort();
			}

	auto ret = kTrustyApp.Write(data, size);		void testOneInput(FuzzedDataProvider& provider) {
	if (ret.ok()) {		std::vector<TrustyApp> trustyApps;
	ret = kTrustyApp.Read(&buf, sizeof(buf));
			while (provider.remaining_bytes() > 0) {
			static_assert(MAX_CONNECTIONS >= 1);

			// Either
			// 1. Add a new TA and connect.
			// 2. Remove a TA.
			// 3. Send a random message to a random TA.
			const std::function<void()> options[] = {
			// Add a new TA and connect.
			[&]() {
			if (trustyApps.size() >= MAX_CONNECTIONS) {
			return;
			}
			auto& ta = trustyApps.emplace_back(TIPC_DEV, TRUSTY_APP_PORT);
			abortResult(ta.Connect());
			},
			// Remove a TA.
			[&]() {
			if (trustyApps.empty()) {
			return;
			}
			trustyApps.pop_back();
			},
			// Send a random message to a random TA.
			[&]() {
			if (trustyApps.empty()) {
			return;
	}		}

	// Reconnect to ensure that the service is still up		// Choose a random TA.
	kTrustyApp.Disconnect();		const auto i =
	ret = kTrustyApp.Connect();		provider.ConsumeIntegralInRange<size_t>(0, trustyApps.size() - 1);
	if (!ret.ok()) {		std::swap(trustyApps[i], trustyApps.back());
	std::cerr << ret.error() << std::endl;		auto& ta = trustyApps.back();
	android::trusty::fuzz::Abort();
			// Send a random message.
			const auto data = provider.ConsumeRandomLengthString();
			abortResult(ta.Write(data.data(), data.size()));

			std::array<uint8_t, TIPC_MAX_MSG_SIZE> buf;
			abortResult(ta.Read(buf.data(), buf.size()));

			// Reconnect to ensure that the service is still up.
			ta.Disconnect();
			abortResult(ta.Connect());
			},
			};

			provider.PickValueInArray(options)();
	}		}
			}

			extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
			ExtraCounters counters(record.get());
			counters.Reset();

	return ret.ok() ? 0 : -1;		FuzzedDataProvider provider(data, size);
			testOneInput(provider);
			return 0;
	}		}