blob: ed32e890a2dacc4496f0a3bd657b22fe0c3eb128 [file] [log] [blame]
Robert Swiecki0e673882016-03-31 18:50:29 +02001/*
2 *
3 * honggfuzz - routines dealing with subprocesses
4 * -----------------------------------------
5 *
6 * Author:
7 * Robert Swiecki <swiecki@google.com>
8 * Felix Gröbert <groebert@google.com>
9 *
10 * Copyright 2010-2015 by Google Inc. All Rights Reserved.
11 *
12 * Licensed under the Apache License, Version 2.0 (the "License"); you may
13 * not use this file except in compliance with the License. You may obtain
14 * a copy of the License at
15 *
16 * http://www.apache.org/licenses/LICENSE-2.0
17 *
18 * Unless required by applicable law or agreed to in writing, software
19 * distributed under the License is distributed on an "AS IS" BASIS,
20 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
21 * implied. See the License for the specific language governing
22 * permissions and limitations under the License.
23 *
24 */
25
26#include "common.h"
27#include "subproc.h"
28
Jagger93253f72016-09-01 22:40:12 +020029#include <fcntl.h>
Jaggerc7743512016-08-31 22:00:19 +020030#include <inttypes.h>
Robert Swiecki0e673882016-03-31 18:50:29 +020031#include <signal.h>
32#include <stdio.h>
Jaggerc7743512016-08-31 22:00:19 +020033#include <stdlib.h>
Robert Swiecki0e673882016-03-31 18:50:29 +020034#include <string.h>
Jaggerc7743512016-08-31 22:00:19 +020035#include <sys/resource.h>
Jagger93253f72016-09-01 22:40:12 +020036#include <sys/socket.h>
Jaggerc7743512016-08-31 22:00:19 +020037#include <sys/time.h>
Robert Swiecki0e673882016-03-31 18:50:29 +020038#include <sys/types.h>
39#include <sys/wait.h>
Jaggerc7743512016-08-31 22:00:19 +020040#include <unistd.h>
Robert Swiecki0e673882016-03-31 18:50:29 +020041
Jagger93253f72016-09-01 22:40:12 +020042#include "arch.h"
Jaggerc4729592016-09-02 01:52:30 +020043#include "files.h"
Robert Swiecki0e673882016-03-31 18:50:29 +020044#include "log.h"
Jaggerc7743512016-08-31 22:00:19 +020045#include "sancov.h"
46#include "util.h"
47
48extern char **environ;
Robert Swiecki0e673882016-03-31 18:50:29 +020049
50const char *subproc_StatusToStr(int status, char *str, size_t len)
51{
52 if (WIFEXITED(status)) {
53 snprintf(str, len, "EXITED, exit code: %d", WEXITSTATUS(status));
54 return str;
55 }
56
57 if (WIFSIGNALED(status)) {
58 snprintf(str, len, "SIGNALED, signal: %d (%s)", WTERMSIG(status),
59 strsignal(WTERMSIG(status)));
60 return str;
61 }
Robert Swiecki0e673882016-03-31 18:50:29 +020062 if (WIFCONTINUED(status)) {
63 snprintf(str, len, "CONTINUED");
64 return str;
65 }
66
67 if (!WIFSTOPPED(status)) {
68 snprintf(str, len, "UNKNOWN STATUS: %d", status);
69 return str;
70 }
71
72 /* Must be in a stopped state */
73 if (WSTOPSIG(status) == (SIGTRAP | 0x80)) {
74 snprintf(str, len, "STOPPED (linux syscall): %d (%s)", WSTOPSIG(status),
75 strsignal(WSTOPSIG(status)));
76 return str;
77 }
Robert Swiecki2531d752016-04-19 14:00:17 +020078#if defined(PTRACE_EVENT_STOP)
Robert Swiecki0e673882016-03-31 18:50:29 +020079#define __LINUX_WPTRACEEVENT(x) ((x & 0xff0000) >> 16)
80 if (WSTOPSIG(status) == SIGTRAP && __LINUX_WPTRACEEVENT(status) != 0) {
81 switch (__LINUX_WPTRACEEVENT(status)) {
Robert Swiecki2531d752016-04-19 14:00:17 +020082 case PTRACE_EVENT_FORK:
Robert Swieckicd3eb5b2016-03-31 18:55:38 +020083 snprintf(str, len, "EVENT (Linux) - fork - with signal: %d (%s)", WSTOPSIG(status),
84 strsignal(WSTOPSIG(status)));
85 return str;
Robert Swiecki2531d752016-04-19 14:00:17 +020086 case PTRACE_EVENT_VFORK:
Robert Swieckicd3eb5b2016-03-31 18:55:38 +020087 snprintf(str, len, "EVENT (Linux) - vfork - with signal: %d (%s)", WSTOPSIG(status),
88 strsignal(WSTOPSIG(status)));
89 return str;
Robert Swiecki2531d752016-04-19 14:00:17 +020090 case PTRACE_EVENT_CLONE:
Robert Swieckicd3eb5b2016-03-31 18:55:38 +020091 snprintf(str, len, "EVENT (Linux) - clone - with signal: %d (%s)", WSTOPSIG(status),
92 strsignal(WSTOPSIG(status)));
93 return str;
Robert Swiecki2531d752016-04-19 14:00:17 +020094 case PTRACE_EVENT_EXEC:
Robert Swieckicd3eb5b2016-03-31 18:55:38 +020095 snprintf(str, len, "EVENT (Linux) - exec - with signal: %d (%s)", WSTOPSIG(status),
96 strsignal(WSTOPSIG(status)));
97 return str;
Robert Swiecki2531d752016-04-19 14:00:17 +020098 case PTRACE_EVENT_VFORK_DONE:
Robert Swieckicd3eb5b2016-03-31 18:55:38 +020099 snprintf(str, len, "EVENT (Linux) - vfork_done - with signal: %d (%s)",
100 WSTOPSIG(status), strsignal(WSTOPSIG(status)));
101 return str;
Robert Swiecki2531d752016-04-19 14:00:17 +0200102 case PTRACE_EVENT_EXIT:
Robert Swieckicd3eb5b2016-03-31 18:55:38 +0200103 snprintf(str, len, "EVENT (Linux) - exit - with signal: %d (%s)", WSTOPSIG(status),
104 strsignal(WSTOPSIG(status)));
105 return str;
Robert Swiecki2531d752016-04-19 14:00:17 +0200106 case PTRACE_EVENT_SECCOMP:
Robert Swieckicd3eb5b2016-03-31 18:55:38 +0200107 snprintf(str, len, "EVENT (Linux) - seccomp - with signal: %d (%s)", WSTOPSIG(status),
108 strsignal(WSTOPSIG(status)));
109 return str;
Robert Swiecki2531d752016-04-19 14:00:17 +0200110 case PTRACE_EVENT_STOP:
Robert Swieckicd3eb5b2016-03-31 18:55:38 +0200111 snprintf(str, len, "EVENT (Linux) - stop - with signal: %d (%s)", WSTOPSIG(status),
Robert Swiecki0e673882016-03-31 18:50:29 +0200112 strsignal(WSTOPSIG(status)));
113 return str;
114 default:
115 snprintf(str, len, "EVENT (Linux) UNKNOWN (%d): with signal: %d (%s)",
116 __LINUX_WPTRACEEVENT(status), WSTOPSIG(status), strsignal(WSTOPSIG(status)));
117 return str;
118 }
119 }
Robert Swiecki2531d752016-04-19 14:00:17 +0200120#endif /* defined(PTRACE_EVENT_STOP) */
Robert Swiecki0e673882016-03-31 18:50:29 +0200121
122 snprintf(str, len, "STOPPED with signal: %d (%s)", WSTOPSIG(status),
123 strsignal(WSTOPSIG(status)));
124 return str;
125}
Jaggerc7743512016-08-31 22:00:19 +0200126
Robert Swiecki940a0802016-11-02 12:42:09 +0100127bool subproc_persistentModeRoundDone(honggfuzz_t * hfuzz, fuzzer_t * fuzzer)
128{
129 if (hfuzz->persistent == false) {
130 return false;
131 }
Robert Swieckibcfdb972016-11-23 20:33:41 +0100132 char z;
Robert Swiecki940a0802016-11-02 12:42:09 +0100133 if (recv(fuzzer->persistentSock, &z, sizeof(z), MSG_DONTWAIT) == sizeof(z)) {
134 LOG_D("Persistent mode round finished");
135 return true;
136 }
137 return false;
138}
139
140static bool subproc_persistentSendFile(fuzzer_t * fuzzer)
141{
142 uint32_t len = (uint64_t) fuzzer->dynamicFileSz;
143 if (files_writeToFd(fuzzer->persistentSock, (uint8_t *) & len, sizeof(len)) == false) {
144 return false;
145 }
146 if (files_writeToFd(fuzzer->persistentSock, fuzzer->dynamicFile, fuzzer->dynamicFileSz) ==
147 false) {
148 return false;
149 }
150 return true;
151}
152
Jaggerc7743512016-08-31 22:00:19 +0200153bool subproc_PrepareExecv(honggfuzz_t * hfuzz, fuzzer_t * fuzzer, const char *fileName)
154{
155 /*
Jaggerc7743512016-08-31 22:00:19 +0200156 * The address space limit. If big enough - roughly the size of RAM used
157 */
158 if (hfuzz->asLimit) {
159 struct rlimit rl = {
160 .rlim_cur = hfuzz->asLimit * 1024ULL * 1024ULL,
161 .rlim_max = hfuzz->asLimit * 1024ULL * 1024ULL,
162 };
163 if (setrlimit(RLIMIT_AS, &rl) == -1) {
164 PLOG_D("Couldn't enforce the RLIMIT_AS resource limit, ignoring");
165 }
166 }
167
168 if (hfuzz->nullifyStdio) {
169 util_nullifyStdio();
170 }
171
172 if (hfuzz->fuzzStdin) {
173 /*
174 * Uglyyyyyy ;)
175 */
176 if (!util_redirectStdin(fileName)) {
177 return false;
178 }
179 }
180
181 if (hfuzz->clearEnv) {
182 environ = NULL;
183 }
Anestis Bechtsoudise5f09f82016-12-27 16:06:05 +0200184 if (sanitizers_prepareExecve(hfuzz) == false) {
185 LOG_E("sanitizers_prepareExecve() failed");
Jaggerc7743512016-08-31 22:00:19 +0200186 return false;
187 }
188 for (size_t i = 0; i < ARRAYSIZE(hfuzz->envs) && hfuzz->envs[i]; i++) {
189 putenv(hfuzz->envs[i]);
190 }
191 char fuzzNo[128];
192 snprintf(fuzzNo, sizeof(fuzzNo), "%" PRId32, fuzzer->fuzzNo);
193 setenv(_HF_THREAD_NO_ENV, fuzzNo, 1);
194
195 setsid();
196
197 if (hfuzz->bbFd != -1) {
198 if (dup2(hfuzz->bbFd, _HF_BITMAP_FD) == -1) {
199 PLOG_F("dup2('%d', %d)", hfuzz->bbFd, _HF_BITMAP_FD);
200 }
Jaggerae663be2016-09-10 03:27:10 +0200201 close(hfuzz->bbFd);
Jaggerc7743512016-08-31 22:00:19 +0200202 }
203
Robert Swiecki491d7bb2017-02-28 03:02:53 +0100204 sigset_t sset;
205 sigemptyset(&sset);
206 if (sigprocmask(SIG_SETMASK, &sset, NULL) == -1) {
207 PLOG_W("sigprocmask(empty_set)");
208 }
209
Jaggerc7743512016-08-31 22:00:19 +0200210 return true;
211}
Jagger93253f72016-09-01 22:40:12 +0200212
Robert Swiecki940a0802016-11-02 12:42:09 +0100213static bool subproc_New(honggfuzz_t * hfuzz, fuzzer_t * fuzzer)
Jagger93253f72016-09-01 22:40:12 +0200214{
215 fuzzer->pid = fuzzer->persistentPid;
216 if (fuzzer->pid != 0) {
217 return true;
218 }
Gergely Nagyf95cda62016-12-12 23:40:16 +0100219 fuzzer->tmOutSignaled = false;
Jagger93253f72016-09-01 22:40:12 +0200220
221 int sv[2];
222 if (hfuzz->persistent) {
Jagger82a20c02016-09-02 01:36:39 +0200223 if (fuzzer->persistentSock != -1) {
224 close(fuzzer->persistentSock);
225 }
226
Jaggere4dad652016-09-10 03:35:50 +0200227 int sock_type = SOCK_STREAM;
228#if defined(SOCK_CLOEXEC)
229 sock_type |= SOCK_CLOEXEC;
230#endif
231 if (socketpair(AF_UNIX, sock_type, 0, sv) == -1) {
Jagger93253f72016-09-01 22:40:12 +0200232 PLOG_W("socketpair(AF_UNIX, SOCK_STREAM, 0, sv)");
233 return false;
234 }
Robert Swieckic7a95f82016-10-27 19:29:35 +0200235 fuzzer->persistentSock = sv[0];
Jagger93253f72016-09-01 22:40:12 +0200236 }
237
238 fuzzer->pid = arch_fork(hfuzz, fuzzer);
239 if (fuzzer->pid == -1) {
240 PLOG_F("Couldn't fork");
241 }
Robert Swieckia71a4992016-09-02 14:47:55 +0200242 // Child
Jagger93253f72016-09-01 22:40:12 +0200243 if (!fuzzer->pid) {
244 if (hfuzz->persistent) {
245 if (dup2(sv[1], _HF_PERSISTENT_FD) == -1) {
246 PLOG_F("dup2('%d', '%d')", sv[1], _HF_PERSISTENT_FD);
247 }
248 close(sv[0]);
249 close(sv[1]);
250 }
251
252 if (!subproc_PrepareExecv(hfuzz, fuzzer, fuzzer->fileName)) {
253 LOG_E("subproc_PrepareExecv() failed");
254 exit(EXIT_FAILURE);
255 }
256 if (!arch_launchChild(hfuzz, fuzzer->fileName)) {
257 LOG_E("Error launching child process");
Robert Swieckia7ecf162017-02-12 23:17:41 +0100258 kill(hfuzz->mainPid, SIGTERM);
Robert Swiecki99071002017-02-13 17:16:18 +0100259 exit(EXIT_FAILURE);
Jagger93253f72016-09-01 22:40:12 +0200260 }
Robert Swiecki42cc9822017-02-12 22:20:46 +0100261 abort();
Jagger93253f72016-09-01 22:40:12 +0200262 }
Robert Swieckia71a4992016-09-02 14:47:55 +0200263 // Parent
Anestis Bechtsoudis8171d522016-10-27 11:22:06 +0300264 LOG_D("Launched new process, pid: %d, (concurrency: %zd)", fuzzer->pid, hfuzz->threadsMax);
Jagger68f33592016-09-03 04:52:16 +0200265
Jagger93253f72016-09-01 22:40:12 +0200266 if (hfuzz->persistent) {
Anestis Bechtsoudis8171d522016-10-27 11:22:06 +0300267 close(sv[1]);
Robert Swiecki2a7da342016-10-27 19:27:30 +0200268 LOG_I("Persistent mode: Launched new persistent PID: %d", (int)fuzzer->pid);
269 fuzzer->persistentPid = fuzzer->pid;
Anestis Bechtsoudis8171d522016-10-27 11:22:06 +0300270 }
Jagger93253f72016-09-01 22:40:12 +0200271
272 return true;
273}
Jaggerd1fc9ed2016-09-02 01:06:51 +0200274
Robert Swiecki940a0802016-11-02 12:42:09 +0100275bool subproc_Run(honggfuzz_t * hfuzz, fuzzer_t * fuzzer)
Jaggerc4729592016-09-02 01:52:30 +0200276{
Robert Swiecki940a0802016-11-02 12:42:09 +0100277 if (subproc_New(hfuzz, fuzzer) == false) {
278 LOG_E("subproc_New()");
Jaggerc4729592016-09-02 01:52:30 +0200279 return false;
280 }
Jaggerc4729592016-09-02 01:52:30 +0200281
Jaggerd1fc9ed2016-09-02 01:06:51 +0200282 arch_prepareChild(hfuzz, fuzzer);
Jaggerc4729592016-09-02 01:52:30 +0200283 if (hfuzz->persistent == true && subproc_persistentSendFile(fuzzer) == false) {
284 LOG_W("Could not send file contents to the persistent process");
285 }
Jaggerd1fc9ed2016-09-02 01:06:51 +0200286 arch_reapChild(hfuzz, fuzzer);
Robert Swiecki940a0802016-11-02 12:42:09 +0100287
288 return true;
Jaggerd1fc9ed2016-09-02 01:06:51 +0200289}
Robert Swiecki54333cd2016-09-07 17:51:48 +0200290
291uint8_t subproc_System(const char *const argv[])
292{
293 pid_t pid = fork();
294 if (pid == -1) {
295 PLOG_E("Couldn't fork");
Robert Swieckib0a8d582016-09-09 18:13:00 +0200296 return 255;
Robert Swiecki54333cd2016-09-07 17:51:48 +0200297 }
298
299 if (!pid) {
Robert Swiecki491d7bb2017-02-28 03:02:53 +0100300 sigset_t sset;
301 sigemptyset(&sset);
302 sigprocmask(SIG_SETMASK, &sset, NULL);
Robert Swiecki54333cd2016-09-07 17:51:48 +0200303 execv(argv[0], (char *const *)&argv[0]);
304 PLOG_F("Couldn't execute '%s'", argv[0]);
Robert Swieckib0a8d582016-09-09 18:13:00 +0200305 return 255;
Robert Swiecki54333cd2016-09-07 17:51:48 +0200306 }
307
308 int status;
309 int flags = 0;
310#if defined(__WNOTHREAD)
311 flags |= __WNOTHREAD;
312#endif /* defined(__WNOTHREAD) */
313 while (wait4(pid, &status, flags, NULL) != pid) ;
314 if (WIFSIGNALED(status)) {
315 LOG_E("Command '%s' terminated with signal: %d", argv[0], WTERMSIG(status));
316 return (100 + WTERMSIG(status));
317 }
318 if (!WIFEXITED(status)) {
319 LOG_F("Command '%s' terminated abnormally, status: %d", argv[0], status);
320 return 100;
321 }
322
323 LOG_D("Command '%s' exited with: %d", argv[0], WEXITSTATUS(status));
324
325 if (WEXITSTATUS(status)) {
Robert Swieckicaef4f32016-09-09 18:18:22 +0200326 LOG_W("Command '%s' exited with code: %d", argv[0], WEXITSTATUS(status));
Robert Swiecki54333cd2016-09-07 17:51:48 +0200327 return 1U;
328 }
329
330 return 0U;
331}
Robert Swieckifddc0862016-10-27 12:42:46 +0200332
333void subproc_checkTimeLimit(honggfuzz_t * hfuzz, fuzzer_t * fuzzer)
334{
335 if (hfuzz->tmOut == 0) {
336 return;
337 }
338
339 int64_t curMillis = util_timeNowMillis();
340 int64_t diffMillis = curMillis - fuzzer->timeStartedMillis;
341 if (diffMillis > (hfuzz->tmOut * 1000)) {
Robert Swiecki013bc9c2016-12-12 17:31:06 +0100342 /* Has this instance been already signaled due to timeout? Just, SIGKILL it */
343 if (fuzzer->tmOutSignaled) {
344 LOG_W("PID %d has already been signaled due to timeout. Killing it with SIGKILL",
345 fuzzer->pid);
346 kill(fuzzer->pid, SIGKILL);
347 return;
348 }
349 fuzzer->tmOutSignaled = true;
350
Robert Swieckie84b6452016-12-12 12:42:04 +0100351 LOG_W("PID %d took too much time (limit %ld s). Killing it", fuzzer->pid, hfuzz->tmOut);
352 if (hfuzz->tmout_vtalrm) {
353 kill(fuzzer->pid, SIGVTALRM);
354 } else {
355 kill(fuzzer->pid, SIGKILL);
356 }
Robert Swieckifddc0862016-10-27 12:42:46 +0200357 ATOMIC_POST_INC(hfuzz->timeoutedCnt);
358 }
359}
Robert Swiecki4f09ce02017-02-25 22:47:55 +0100360
361void subproc_checkTermination(honggfuzz_t * hfuzz, fuzzer_t * fuzzer)
362{
363 if (ATOMIC_GET(hfuzz->terminating)) {
364 LOG_D("Killing PID: %d", (int)fuzzer->pid);
365 kill(fuzzer->pid, SIGKILL);
366 }
367}