oslib: do not call g_strdup from qemu_get_exec_dir
[qemu.git] / tests / qtest / fuzz / fuzz.c
1 /*
2 * fuzzing driver
3 *
4 * Copyright Red Hat Inc., 2019
5 *
6 * Authors:
7 * Alexander Bulekov <alxndr@bu.edu>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
11 *
12 */
13
14 #include "qemu/osdep.h"
15
16 #include <wordexp.h>
17
18 #include "sysemu/qtest.h"
19 #include "sysemu/runstate.h"
20 #include "sysemu/sysemu.h"
21 #include "qemu/main-loop.h"
22 #include "qemu/rcu.h"
23 #include "tests/qtest/libqos/libqtest.h"
24 #include "tests/qtest/libqos/qgraph.h"
25 #include "fuzz.h"
26
27 #define MAX_EVENT_LOOPS 10
28
29 typedef struct FuzzTargetState {
30 FuzzTarget *target;
31 QSLIST_ENTRY(FuzzTargetState) target_list;
32 } FuzzTargetState;
33
34 typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList;
35
36 static const char *fuzz_arch = TARGET_NAME;
37
38 static FuzzTargetList *fuzz_target_list;
39 static FuzzTarget *fuzz_target;
40 static QTestState *fuzz_qts;
41
42
43
44 void flush_events(QTestState *s)
45 {
46 int i = MAX_EVENT_LOOPS;
47 while (g_main_context_pending(NULL) && i-- > 0) {
48 main_loop_wait(false);
49 }
50 }
51
52 static QTestState *qtest_setup(void)
53 {
54 qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts);
55 return qtest_inproc_init(&fuzz_qts, false, fuzz_arch,
56 &qtest_server_inproc_recv);
57 }
58
59 void fuzz_add_target(const FuzzTarget *target)
60 {
61 FuzzTargetState *tmp;
62 FuzzTargetState *target_state;
63 if (!fuzz_target_list) {
64 fuzz_target_list = g_new0(FuzzTargetList, 1);
65 }
66
67 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
68 if (g_strcmp0(tmp->target->name, target->name) == 0) {
69 fprintf(stderr, "Error: Fuzz target name %s already in use\n",
70 target->name);
71 abort();
72 }
73 }
74 target_state = g_new0(FuzzTargetState, 1);
75 target_state->target = g_new0(FuzzTarget, 1);
76 *(target_state->target) = *target;
77 QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list);
78 }
79
80
81
82 static void usage(char *path)
83 {
84 printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path);
85 printf("where FUZZ_TARGET is one of:\n");
86 FuzzTargetState *tmp;
87 if (!fuzz_target_list) {
88 fprintf(stderr, "Fuzz target list not initialized\n");
89 abort();
90 }
91 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
92 printf(" * %s : %s\n", tmp->target->name,
93 tmp->target->description);
94 }
95 printf("Alternatively, add -target-FUZZ_TARGET to the executable name\n\n"
96 "Set the environment variable FUZZ_SERIALIZE_QTEST=1 to serialize\n"
97 "QTest commands into an ASCII protocol. Useful for building crash\n"
98 "reproducers, but slows down execution.\n\n"
99 "Set the environment variable QTEST_LOG=1 to log all qtest commands"
100 "\n");
101 exit(0);
102 }
103
104 static FuzzTarget *fuzz_get_target(char* name)
105 {
106 FuzzTargetState *tmp;
107 if (!fuzz_target_list) {
108 fprintf(stderr, "Fuzz target list not initialized\n");
109 abort();
110 }
111
112 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
113 if (strcmp(tmp->target->name, name) == 0) {
114 return tmp->target;
115 }
116 }
117 return NULL;
118 }
119
120
121 /* Executed for each fuzzing-input */
122 int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size)
123 {
124 /*
125 * Do the pre-fuzz-initialization before the first fuzzing iteration,
126 * instead of before the actual fuzz loop. This is needed since libfuzzer
127 * may fork off additional workers, prior to the fuzzing loop, and if
128 * pre_fuzz() sets up e.g. shared memory, this should be done for the
129 * individual worker processes
130 */
131 static int pre_fuzz_done;
132 if (!pre_fuzz_done && fuzz_target->pre_fuzz) {
133 fuzz_target->pre_fuzz(fuzz_qts);
134 pre_fuzz_done = true;
135 }
136
137 fuzz_target->fuzz(fuzz_qts, Data, Size);
138 return 0;
139 }
140
141 /* Executed once, prior to fuzzing */
142 int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)
143 {
144
145 char *target_name;
146 const char *bindir;
147 char *datadir;
148 bool serialize = false;
149
150 /* Initialize qgraph and modules */
151 qos_graph_init();
152 module_call_init(MODULE_INIT_FUZZ_TARGET);
153 module_call_init(MODULE_INIT_QOM);
154 module_call_init(MODULE_INIT_LIBQOS);
155
156 target_name = strstr(**argv, "-target-");
157 if (target_name) { /* The binary name specifies the target */
158 target_name += strlen("-target-");
159 /*
160 * With oss-fuzz, the executable is kept in the root of a directory (we
161 * cannot assume the path). All data (including bios binaries) must be
162 * in the same dir, or a subdir. Thus, we cannot place the pc-bios so
163 * that it would be in exec_dir/../pc-bios.
164 * As a workaround, oss-fuzz allows us to use argv[0] to get the
165 * location of the executable. Using this we add exec_dir/pc-bios to
166 * the datadirs.
167 */
168 bindir = g_path_get_dirname(**argv);
169 datadir = g_build_filename(bindir, "pc-bios", NULL);
170 if (g_file_test(datadir, G_FILE_TEST_IS_DIR)) {
171 qemu_add_data_dir(datadir);
172 }
173 g_free(datadir);
174 } else if (*argc > 1) { /* The target is specified as an argument */
175 target_name = (*argv)[1];
176 if (!strstr(target_name, "--fuzz-target=")) {
177 usage(**argv);
178 }
179 target_name += strlen("--fuzz-target=");
180 } else {
181 usage(**argv);
182 }
183
184 /* Should we always serialize qtest commands? */
185 if (getenv("FUZZ_SERIALIZE_QTEST")) {
186 serialize = true;
187 }
188
189 fuzz_qtest_set_serialize(serialize);
190
191 /* Identify the fuzz target */
192 fuzz_target = fuzz_get_target(target_name);
193 if (!fuzz_target) {
194 usage(**argv);
195 }
196
197 fuzz_qts = qtest_setup();
198
199 if (fuzz_target->pre_vm_init) {
200 fuzz_target->pre_vm_init();
201 }
202
203 /* Run QEMU's softmmu main with the fuzz-target dependent arguments */
204 GString *cmd_line = fuzz_target->get_init_cmdline(fuzz_target);
205 g_string_append_printf(cmd_line, " %s -qtest /dev/null ",
206 getenv("QTEST_LOG") ? "" : "-qtest-log none");
207
208 /* Split the runcmd into an argv and argc */
209 wordexp_t result;
210 wordexp(cmd_line->str, &result, 0);
211 g_string_free(cmd_line, true);
212
213 qemu_init(result.we_wordc, result.we_wordv, NULL);
214
215 /* re-enable the rcu atfork, which was previously disabled in qemu_init */
216 rcu_enable_atfork();
217
218 return 0;
219 }