Merge changes I9830baf7,I01da0a68,I05d0a6c7 into main (e9741b25) · Commits · e / os / android_system_core

fs_mgr/liblp/Android.bp

+6 −1

Original line number	Diff line number	Diff line
		@@ -93,8 +93,8 @@ cc_defaults {
		srcs: [
		"builder_test.cpp",
		"super_layout_builder_test.cpp",
		"test_partition_opener.cpp",
		"utility_test.cpp",
		":TestPartitionOpener_group",
		],
		}

		@@ -122,3 +122,8 @@ cc_test {
		name: "vts_kernel_liblp_test",
		defaults: ["liblp_test_defaults"],
		}

		filegroup {
		name: "TestPartitionOpener_group",
		srcs: [ "test_partition_opener.cpp"],
		}

fs_mgr/liblp/fuzzer/Android.bp

0 → 100644

+201 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2023 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at:
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*
		*/

		cc_defaults {
		name: "liblp_fuzz_defaults",
		header_libs: [
		"libstorage_literals_headers",
		],
		shared_libs: [
		"liblp",
		"libbase",
		"liblog",
		],
		static_libs: [
		"libcutils",
		],
		include_dirs: [
		"system/core/fs_mgr/liblp",
		],
		fuzz_config: {
		cc: [
		"android-media-fuzzing-reports@google.com",
		],
		componentid: 59148,
		hotlists: ["4593311"],
		description: "The fuzzers target the APIs of all liblp modules",
		vector: "local_no_privileges_required",
		service_privilege: "privileged",
		users: "multi_user",
		fuzzed_code_usage: "shipped"
		}
		}

		cc_fuzz {
		name: "liblp_builder_fuzzer",
		srcs: ["liblp_builder_fuzzer.cpp"],
		defaults: ["liblp_fuzz_defaults"],
		}

		cc_fuzz {
		name: "liblp_super_layout_builder_fuzzer",
		srcs: ["liblp_super_layout_builder_fuzzer.cpp"],
		defaults: ["liblp_fuzz_defaults"],
		}

		python_binary_host {
		name: "image_gen_rand",
		srcs: ["image_gen_rand.py"],
		}

		genrule_defaults {
		name: "test_data_gen_defaults",
		tools: [
		"image_gen_rand",
		],
		}

		// Fake dtb image.
		genrule {
		name: "test_dtb",
		defaults: ["test_data_gen_defaults"],
		out: ["test_dtb.img"],
		cmd: "$(location image_gen_rand) --seed dtb --length 1024 > $(out)",
		}

		// Fake bootconfig image.
		genrule {
		name: "test_bootconfig",
		defaults: ["test_data_gen_defaults"],
		out: ["test_bootconfig.img"],
		cmd: "$(location image_gen_rand) --seed bootconfig --length 1024 > $(out)",
		}

		// Fake vendor ramdisk with type "none".
		genrule {
		name: "test_vendor_ramdisk_none",
		defaults: ["test_data_gen_defaults"],
		out: ["test_vendor_ramdisk_none.img"],
		cmd: "$(location image_gen_rand) --seed vendor_ramdisk_none --length 1024 > $(out)",
		}

		// Fake vendor ramdisk with type "platform".
		genrule {
		name: "test_vendor_ramdisk_platform",
		defaults: ["test_data_gen_defaults"],
		out: ["test_vendor_ramdisk_platform.img"],
		cmd: "$(location image_gen_rand) --seed vendor_ramdisk_platform --length 1024 > $(out)",
		}

		// Fake replacement ramdisk.
		genrule {
		name: "test_vendor_ramdisk_replace",
		defaults: ["test_data_gen_defaults"],
		out: ["test_vendor_ramdisk_replace.img"],
		cmd: "$(location image_gen_rand) --seed replace --length 3072 > $(out)",
		}

		// Genrules for test vendor boot images.
		fastboot_sign_test_image = "$(location avbtool) add_hash_footer --salt 00 --image $(out) " +
		"--partition_name vendor_boot --partition_size $$(( 1 * 1024 * 1024 ))"

		genrule_defaults {
		name: "test_vendor_boot_gen_defaults",
		defaults: ["test_data_gen_defaults"],
		tools: [
		"avbtool",
		"mkbootimg",
		],
		}

		genrule {
		name: "test_vendor_boot_v3",
		defaults: ["test_vendor_boot_gen_defaults"],
		out: ["test_vendor_boot_v3.img"],
		srcs: [
		":test_dtb",
		":test_vendor_ramdisk_none",
		],
		cmd: "$(location mkbootimg) --header_version 3 " +
		"--vendor_ramdisk $(location :test_vendor_ramdisk_none) " +
		"--dtb $(location :test_dtb) " +
		"--vendor_boot $(out) && " +
		fastboot_sign_test_image,
		}

		genrule {
		name: "test_vendor_boot_v4_without_frag",
		defaults: ["test_vendor_boot_gen_defaults"],
		out: ["test_vendor_boot_v4_without_frag.img"],
		srcs: [
		":test_dtb",
		":test_vendor_ramdisk_none",
		":test_bootconfig",
		],
		cmd: "$(location mkbootimg) --header_version 4 " +
		"--vendor_ramdisk $(location :test_vendor_ramdisk_none) " +
		"--dtb $(location :test_dtb) " +
		"--vendor_bootconfig $(location :test_bootconfig) " +
		"--vendor_boot $(out) && " +
		fastboot_sign_test_image,
		}

		genrule {
		name: "test_vendor_boot_v4_with_frag",
		defaults: ["test_vendor_boot_gen_defaults"],
		out: ["test_vendor_boot_v4_with_frag.img"],
		srcs: [
		":test_dtb",
		":test_vendor_ramdisk_none",
		":test_vendor_ramdisk_platform",
		":test_bootconfig",
		],
		cmd: "$(location mkbootimg) --header_version 4 " +
		"--dtb $(location :test_dtb) " +
		"--vendor_bootconfig $(location :test_bootconfig) " +
		"--ramdisk_type none --ramdisk_name none_ramdisk " +
		"--vendor_ramdisk_fragment $(location :test_vendor_ramdisk_none) " +
		"--ramdisk_type platform --ramdisk_name platform_ramdisk " +
		"--vendor_ramdisk_fragment $(location :test_vendor_ramdisk_platform) " +
		"--vendor_boot $(out) && " +
		fastboot_sign_test_image,
		}

		cc_fuzz {
		name: "liblp_apis_fuzzer",
		srcs: [
		"liblp_apis_fuzzer.cpp",
		":TestPartitionOpener_group",
		],
		defaults: ["liblp_fuzz_defaults"],
		shared_libs: [
		"libsparse",
		],
		data: [
		":test_dtb",
		":test_bootconfig",
		":test_vendor_ramdisk_none",
		":test_vendor_ramdisk_platform",
		":test_vendor_ramdisk_replace",
		":test_vendor_boot_v3",
		":test_vendor_boot_v4_without_frag",
		":test_vendor_boot_v4_with_frag",
		],
		cflags: [
		"-Wno-unused-parameter",
		],
		}

fs_mgr/liblp/fuzzer/README.md

0 → 100644

+136 −0

Original line number	Diff line number	Diff line
		# Fuzzers for liblp
		## Table of contents
		+ [liblp_builder_fuzzer](#Builder)
		+ [liblp_super_layout_builder_fuzzer](#SuperBuilder)
		+ [liblp_apis_fuzzer](#APIs)

		# <a name="Builder"></a> Fuzzer for LiblpBuilder

		LiblpBuilder supports the following parameters:
		1. kAttributeTypes (parameter name: "attribute")
		2. blockDevSize (parameter name: "blockdev_size")
		3. metadataMaxSize (parameter name: "metadata_max_size")
		4. metadataSlotCount (parameter name: "metadata_slot_count")
		5. partitionName (parameter name: "partition_name")
		6. superBlockDeviceName (parameter name: "block_device_name")
		7. blockDeviceInfoSize (parameter name: "block_device_info_size")
		8. alignment (parameter name: "alignment")
		9. alignmentOffset (parameter name: "alignment_offset")
		10. logicalBlockSize (parameter name: "logical_block_size")
		11. maxMetadataSize (parameter name: "max_metadata_size")
		12. numSlots (parameter name: "metadata_slot_count")
		13. deviceIndex (parameter name: "device_index")
		14. start (parameter name: "start")
		15. end (parameter name: "end")
		16. addedGroupName (parameter name: "group_name")
		17. partitionGroupName (parameter name: "partition_name")
		18. numSectors (parameter name: "num_sectors")
		19. physicalSector (parameter name: "physical_sector")
		20. resizedPartitionSize (parameter name: "requested_size")

		\| Parameter\| Valid Values\| Configured Value\|
		\|------------- \|-------------\| ----- \|
		\|`kAttributeTypes`\| 1.`LP_PARTITION_ATTR_NONE`,<br/> 2.`LP_PARTITION_ATTR_READONLY`,<br/> 3.`LP_PARTITION_ATTR_SLOT_SUFFIXED`,<br/> 4.`LP_PARTITION_ATTR_UPDATED`,<br/> 5.`LP_PARTITION_ATTR_DISABLED`\|Value obtained from FuzzedDataProvider\|
		\|`blockDevSize`\| Integer value from `0` to `100000`\|Value obtained from FuzzedDataProvider\|
		\|`metadataMaxSize`\| Integer value from `0` to `10000` \|Value obtained from FuzzedDataProvider\|
		\|`metadataSlotCount`\| Integer value from `0` to `2` \|Value obtained from FuzzedDataProvider\|
		\|`partitionName`\| String \|Value obtained from FuzzedDataProvider\|
		\|`superBlockDeviceName`\| String \|Value obtained from FuzzedDataProvider\|
		\|`blockDeviceInfoSize`\| Integer \|Value obtained from FuzzedDataProvider\|
		\|`alignment`\| Integer \|Value obtained from FuzzedDataProvider\|
		\|`alignmentOffset`\| Integer \|Value obtained from FuzzedDataProvider\|
		\|`logicalBlockSize`\| Integer \|Value obtained from FuzzedDataProvider\|
		\|`maxMetadataSize`\| Integer value from `0` to `10000` \|Value obtained from FuzzedDataProvider\|
		\|`numSlots`\| Integer value from `0` to `2` \|Value obtained from FuzzedDataProvider\|
		\|`deviceIndex`\| Integer \|Value obtained from FuzzedDataProvider\|
		\|`start`\| Integer \|Value obtained from FuzzedDataProvider\|
		\|`end`\| Integer \|Value obtained from FuzzedDataProvider\|
		\|`partitionGroupName`\| String \|Value obtained from FuzzedDataProvider\|
		\|`numSectors`\| Integer value from `1` to `1000000` \|Value obtained from FuzzedDataProvider\|
		\|`physicalSector`\| Integer value from `1` to `1000000` \|Value obtained from FuzzedDataProvider\|
		\|`resizedPartitionSize`\| Integer value from `0` to `10000` \|Value obtained from FuzzedDataProvider\|

		#### Steps to run
		1. Build the fuzzer
		```
		$ mm -j$(nproc) liblp_builder_fuzzer
		```
		2. Run on device
		```
		$ adb sync data
		$ adb shell /data/fuzz/arm64/liblp_builder_fuzzer/liblp_builder_fuzzer
		```

		# <a name="SuperBuilder"></a> Fuzzer for LiblpSuperLayoutBuilder

		SuperLayoutBuilder supports the following parameters:
		1. kAttributeTypes (parameter name: "attribute")
		2. blockDevSize (parameter name: "blockdev_size")
		3. metadataMaxSize (parameter name: "metadata_max_size")
		4. metadataSlotCount (parameter name: "metadata_slot_count")
		5. partitionName (parameter name: "partition_name")
		6. data (parameter name: "data")
		7. imageName (parameter name: "image_name")

		\| Parameter\| Valid Values\| Configured Value\|
		\|------------- \|-------------\| ----- \|
		\|`kAttributeTypes`\| 1.`LP_PARTITION_ATTR_NONE`,<br/> 2.`LP_PARTITION_ATTR_READONLY`,<br/> 3.`LP_PARTITION_ATTR_SLOT_SUFFIXED`,<br/> 4.`LP_PARTITION_ATTR_UPDATED`,<br/> 5.`LP_PARTITION_ATTR_DISABLED`\|Value obtained from FuzzedDataProvider\|
		\|`blockDevSize`\| Integer value from `0` to `100000`\|Value obtained from FuzzedDataProvider\|
		\|`metadataMaxSize`\| Integer value from `0` to `10000` \|Value obtained from FuzzedDataProvider\|
		\|`metadataSlotCount`\| Integer value from `0` to `2` \|Value obtained from FuzzedDataProvider\|
		\|`partitionName`\| String \|Value obtained from FuzzedDataProvider\|
		\|`data`\| String \|Value obtained from FuzzedDataProvider\|
		\|`imageName`\| String \|Value obtained from FuzzedDataProvider\|

		#### Steps to run
		1. Build the fuzzer
		```
		$ mm -j$(nproc) liblp_super_layout_builder_fuzzer
		```
		2. Run on device
		```
		$ adb sync data
		$ adb shell /data/fuzz/arm64/liblp_super_layout_builder_fuzzer/liblp_super_layout_builder_fuzzer
		```

		# <a name="APIs"></a> Fuzzer for LiblpApis

		LiblpAPIs supports the following parameters:
		1. blockDeviceInfoSize (parameter name: "block_device_info_size")
		2. alignment (parameter name: "alignment")
		3. alignmentOffset (parameter name: "alignment_offset")
		4. logicalBlockSize (parameter name: "logical_block_size")
		5. blockDevSize (parameter name: "blockdev_size")
		6. metadataMaxSize (parameter name: "metadata_max_size")
		7. metadataSlotCount (parameter name: "metadata_slot_count")
		8. blockDeviceInfoName (parameter name: "block_device_info_name")
		9. numSectors (parameter name: "num_sectors")
		10. physicalSector (parameter name: "physical_sector")
		11. sparsify (parameter name: "sparsify")
		12. buffer (parameter name: "data")

		\| Parameter\| Valid Values\| Configured Value\|
		\|------------- \|-------------\| ----- \|
		\|`blockDeviceInfoSize`\| Integer \|Value obtained from FuzzedDataProvider\|
		\|`alignment`\| Integer \|Value obtained from FuzzedDataProvider\|
		\|`alignmentOffset`\| Integer \|Value obtained from FuzzedDataProvider\|
		\|`logicalBlockSize`\| Integer \|Value obtained from FuzzedDataProvider\|
		\|`blockDevSize`\| Integer value in multiples of `LP_SECTOR_SIZE`\|Value obtained from FuzzedDataProvider\|
		\|`metadataMaxSize`\| Integer value from `0` to `10000` \|Value obtained from FuzzedDataProvider\|
		\|`metadataSlotCount`\| Integer value from `0` to `2` \|Value obtained from FuzzedDataProvider\|
		\|`blockDeviceInfoName`\| String \|Value obtained from FuzzedDataProvider\|
		\|`numSectors`\| Integer value from `1` to `1000000` \|Value obtained from FuzzedDataProvider\|
		\|`physicalSector`\| Integer value from `1` to `1000000` \|Value obtained from FuzzedDataProvider\|
		\|`alignment`\| Bool \|Value obtained from FuzzedDataProvider\|
		\|`alignment`\| Vector \|Value obtained from FuzzedDataProvider\|

		#### Steps to run
		1. Build the fuzzer
		```
		$ mm -j$(nproc) liblp_apis_fuzzer
		```
		2. Run on device
		```
		$ adb sync data
		$ adb shell /data/fuzz/arm64/liblp_apis_fuzzer/liblp_apis_fuzzer
		```

fs_mgr/liblp/fuzzer/image_gen_rand.py

0 → 100644

+32 −0

Original line number	Diff line number	Diff line
		#!/usr/bin/env python3

		# Copyright (C) 2023 The Android Open Source Project
		#
		# Licensed under the Apache License, Version 2.0 (the "License");
		# you may not use this file except in compliance with the License.
		# You may obtain a copy of the License at
		#
		# http://www.apache.org/licenses/LICENSE-2.0
		#
		# Unless required by applicable law or agreed to in writing, software
		# distributed under the License is distributed on an "AS IS" BASIS,
		# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		# See the License for the specific language governing permissions and
		# limitations under the License.

		"""
		Write given number of random bytes, generated with optional seed.
		"""

		import random, argparse

		if __name__ == '__main__':
		parser = argparse.ArgumentParser(description=__doc__)
		parser.add_argument('--seed', help='Seed to random generator')
		parser.add_argument('--length', type=int, required=True, help='Length of output')
		args = parser.parse_args()

		if args.seed:
		random.seed(args.seed)

		print(''.join(chr(random.randrange(0,0xff)) for _ in range(args.length)))

fs_mgr/liblp/fuzzer/liblp_apis_fuzzer.cpp

0 → 100644

+243 −0

File added.

Preview size limit exceeded, changes collapsed.