logd: add fuzzer for SerializedLogBuffer and other improvements (f2774a04) · Commits · e / os / android_system_core

logd/LogTags.cpp

+2 −0

Original line number	Diff line number	Diff line
		@@ -276,7 +276,9 @@ void LogTags::ReadFileEventLogTags(const char* filename, bool warn) {
		cp++;
		}
		} else if (warn) {
		#ifdef __ANDROID__
		LOG(ERROR) << "Cannot read " << filename;
		#endif
		}
		}

logd/fuzz/Android.bp

+21 −7

Original line number	Diff line number	Diff line
		@@ -13,11 +13,9 @@
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/
		cc_fuzz {
		name: "log_buffer_log_fuzzer",
		srcs: [
		"log_buffer_log_fuzzer.cpp",
		],

		cc_defaults {
		name: "log_fuzzer_defaults",
		static_libs: [
		"libbase",
		"libcutils",
		@@ -25,9 +23,25 @@ cc_fuzz {
		"liblog",
		"liblogd",
		"libcutils",
		"libsysutils",
		"libz",
		"libzstd",
		],
		cflags: ["-Werror"],
		cflags: ["-Wextra"],
		host_supported: true,
		}

		cc_fuzz {
		name: "log_buffer_log_fuzzer",
		defaults: ["log_fuzzer_defaults"],
		srcs: [
		"log_buffer_log_fuzzer.cpp",
		],
		}

		cc_fuzz {
		name: "serialized_log_buffer_fuzzer",
		defaults: ["log_fuzzer_defaults"],
		srcs: [
		"serialized_log_buffer_fuzzer.cpp",
		],
		}

logd/fuzz/log_buffer_log_fuzzer.cpp

+52 −7

Original line number	Diff line number	Diff line
		@@ -15,10 +15,13 @@
		*/
		#include <string>

		#include <android-base/logging.h>

		#include "../ChattyLogBuffer.h"
		#include "../LogReaderList.h"
		#include "../LogReaderThread.h"
		#include "../LogStatistics.h"
		#include "../SerializedLogBuffer.h"

		// We don't want to waste a lot of entropy on messages
		#define MAX_MSG_LENGTH 5
		@@ -27,7 +30,20 @@
		#define MIN_TAG_ID 1000
		#define TAG_MOD 10

		namespace android {
		#ifndef __ANDROID__
		unsigned long __android_logger_get_buffer_size(log_id_t) {
		return 1024 * 1024;
		}

		bool __android_logger_valid_buffer_size(unsigned long) {
		return true;
		}
		#endif

		char* android::uidToName(uid_t) {
		return strdup("fake");
		}

		struct LogInput {
		public:
		log_id_t log_id;
		@@ -79,9 +95,13 @@ int write_log_messages(const uint8_t** pdata, size_t* data_left, LogBuffer* log_
		return 1;
		}

		char* uidToName(uid_t) {
		return strdup("fake");
		}
		class NoopWriter : public LogWriter {
		public:
		NoopWriter() : LogWriter(0, true) {}
		bool Write(const logger_entry&, const char*) override { return true; }

		std::string name() const override { return "noop_writer"; }
		};

		extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		// We want a random tag length and a random remaining message length
		@@ -89,11 +109,18 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		return 0;
		}

		android::base::SetMinimumLogSeverity(android::base::ERROR);

		LogReaderList reader_list;
		LogTags tags;
		PruneList prune_list;
		LogStatistics stats(true);
		LogBuffer* log_buffer = new ChattyLogBuffer(&reader_list, &tags, &prune_list, &stats);
		std::unique_ptr<LogBuffer> log_buffer;
		#ifdef FUZZ_SERIALIZED
		log_buffer.reset(new SerializedLogBuffer(&reader_list, &tags, &stats));
		#else
		log_buffer.reset(new ChattyLogBuffer(&reader_list, &tags, &prune_list, &stats));
		#endif
		size_t data_left = size;
		const uint8_t** pdata = &data;

		@@ -102,12 +129,30 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		log_id_for_each(i) { log_buffer->SetSize(i, 10000); }

		while (data_left >= sizeof(LogInput) + 2 * sizeof(uint8_t)) {
		if (!write_log_messages(pdata, &data_left, log_buffer, &stats)) {
		if (!write_log_messages(pdata, &data_left, log_buffer.get(), &stats)) {
		return 0;
		}
		}

		// Read out all of the logs.
		{
		auto lock = std::unique_lock{reader_list.reader_threads_lock()};
		std::unique_ptr<LogWriter> test_writer(new NoopWriter());
		std::unique_ptr<LogReaderThread> log_reader(
		new LogReaderThread(log_buffer.get(), &reader_list, std::move(test_writer), true, 0,
		kLogMaskAll, 0, {}, 1, {}));
		reader_list.reader_threads().emplace_back(std::move(log_reader));
		}

		// Wait until the reader has finished.
		while (true) {
		usleep(50);
		auto lock = std::unique_lock{reader_list.reader_threads_lock()};
		if (reader_list.reader_threads().size() == 0) {
		break;
		}
		}

		log_id_for_each(i) { log_buffer->Clear(i, 0); }
		return 0;
		}
		} // namespace android

logd/fuzz/serialized_log_buffer_fuzzer.cpp

0 → 100644

+19 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright 2020 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#define FUZZ_SERIALIZED

		#include "log_buffer_log_fuzzer.cpp"