blob: 90599504d3a0f54ad2ed9e8d78011d3e90f3ac84 [file] [log] [blame]
robert.swiecki3bb518c2010-10-14 00:48:24 +00001/*
robert.swiecki@gmail.com3b630b42015-02-16 10:53:53 +00002 *
robert.swiecki@gmail.com90e99112015-02-15 02:05:14 +00003 * honggfuzz - fuzzing routines
4 * -----------------------------------------
robert.swiecki@gmail.com3b630b42015-02-16 10:53:53 +00005 *
robert.swiecki@gmail.com8531f692015-02-17 12:25:36 +00006 * Author:
7 * Robert Swiecki <swiecki@google.com>
8 * Felix Gröbert <groebert@google.com>
robert.swiecki@gmail.com3b630b42015-02-16 10:53:53 +00009 *
robert.swiecki@gmail.com772b33d2015-02-14 20:35:00 +000010 * Copyright 2010-2015 by Google Inc. All Rights Reserved.
robert.swiecki@gmail.com3b630b42015-02-16 10:53:53 +000011 *
12 * Licensed under the Apache License, Version 2.0 (the "License"); you may
13 * not use this file except in compliance with the License. You may obtain
robert.swiecki@gmail.com772b33d2015-02-14 20:35:00 +000014 * a copy of the License at
robert.swiecki@gmail.com3b630b42015-02-16 10:53:53 +000015 *
robert.swiecki@gmail.com772b33d2015-02-14 20:35:00 +000016 * http://www.apache.org/licenses/LICENSE-2.0
robert.swiecki@gmail.com3b630b42015-02-16 10:53:53 +000017 *
robert.swiecki@gmail.com772b33d2015-02-14 20:35:00 +000018 * Unless required by applicable law or agreed to in writing, software
19 * distributed under the License is distributed on an "AS IS" BASIS,
20 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
21 * implied. See the License for the specific language governing
22 * permissions and limitations under the License.
robert.swiecki@gmail.com3b630b42015-02-16 10:53:53 +000023 *
robert.swiecki@gmail.com772b33d2015-02-14 20:35:00 +000024 */
robert.swiecki3bb518c2010-10-14 00:48:24 +000025
robert.swiecki@gmail.comba85c3e2015-02-02 14:55:16 +000026#include "fuzz.h"
27
28#include <errno.h>
29#include <fcntl.h>
robert.swiecki@gmail.com90e99112015-02-15 02:05:14 +000030#include <inttypes.h>
Robert Swiecki2af83ec2017-06-05 23:54:22 +020031#include <libgen.h>
robert.swiecki@gmail.com882900b2015-02-11 13:56:22 +000032#include <pthread.h>
robert.swiecki@gmail.comba85c3e2015-02-02 14:55:16 +000033#include <signal.h>
34#include <stddef.h>
35#include <stdint.h>
36#include <stdio.h>
37#include <stdlib.h>
38#include <string.h>
Robert Swiecki10eeb0a2017-09-28 15:42:52 +020039#include <sys/mman.h>
robert.swiecki3bb518c2010-10-14 00:48:24 +000040#include <sys/param.h>
41#include <sys/stat.h>
robert.swiecki@gmail.comba85c3e2015-02-02 14:55:16 +000042#include <sys/time.h>
43#include <sys/types.h>
robert.swiecki3bb518c2010-10-14 00:48:24 +000044#include <time.h>
robert.swiecki@gmail.comba85c3e2015-02-02 14:55:16 +000045#include <unistd.h>
robert.swiecki3bb518c2010-10-14 00:48:24 +000046
Robert Swieckid0fa62c2017-09-28 18:11:05 +020047#include "arch.h"
48#include "honggfuzz.h"
49#include "input.h"
Robert Swiecki10eeb0a2017-09-28 15:42:52 +020050#include "libcommon/common.h"
Robert Swiecki241a7412017-05-24 01:53:15 +020051#include "libcommon/files.h"
52#include "libcommon/log.h"
Robert Swiecki241a7412017-05-24 01:53:15 +020053#include "libcommon/util.h"
robert.swiecki@gmail.com36700b52015-02-22 05:03:16 +000054#include "mangle.h"
robert.swiecki@gmail.come7190b92015-02-14 23:05:42 +000055#include "report.h"
Robert Swieckiec7b8452017-06-01 13:25:56 +020056#include "sancov.h"
57#include "sanitizers.h"
Robert Swiecki2d016902017-05-24 02:12:30 +020058#include "subproc.h"
robert.swiecki3bb518c2010-10-14 00:48:24 +000059
Jagger6113c432015-09-24 05:00:28 +020060static pthread_t fuzz_mainThread;
61
Robert Swiecki4e595fb2017-10-11 17:26:51 +020062static void fuzz_getFileName(honggfuzz_t* hfuzz, fuzzer_t* fuzzer)
robert.swiecki3bb518c2010-10-14 00:48:24 +000063{
Robert Swiecki2b3ecfe2017-06-05 20:43:50 +020064 snprintf(fuzzer->fileName, PATH_MAX, "%s/honggfuzz.input.%" PRIu32 ".%s.%s", hfuzz->workDir,
Robert Swiecki4e595fb2017-10-11 17:26:51 +020065 fuzzer->fuzzNo, basename(hfuzz->cmdline[0]), hfuzz->fileExtn);
robert.swiecki3bb518c2010-10-14 00:48:24 +000066}
67
Robert Swiecki4e595fb2017-10-11 17:26:51 +020068static bool fuzz_prepareFileDynamically(honggfuzz_t* hfuzz, fuzzer_t* fuzzer)
robert.swiecki@gmail.com6d6f7562015-02-17 22:18:51 +000069{
Robert Swieckib10d2b62017-02-10 13:13:10 +010070 fuzzer->origFileName = "[DYNAMIC]";
Robert Swiecki4e595fb2017-10-11 17:26:51 +020071 struct dynfile_t* dynfile;
Robert Swieckia08ab1c2016-03-14 18:29:21 +010072
73 {
Robert Swieckibf8f8cc2017-11-09 00:42:50 +010074 MX_SCOPED_RWLOCK_READ(&hfuzz->dynfileq_mutex);
Robert Swiecki4b0390a2016-03-14 18:44:05 +010075
Jaggerb070b812016-03-15 05:31:30 +010076 if (hfuzz->dynfileqCnt == 0) {
Jaggere4496512016-03-16 01:55:46 +010077 LOG_F("The dynamic file corpus is empty. Apparently, the initial fuzzing of the "
78 "provided file corpus (-f) has not produced any follow-up files with positive "
79 "coverage and/or CPU counters");
Jaggerb070b812016-03-15 05:31:30 +010080 }
81
Robert Swieckibf8f8cc2017-11-09 00:42:50 +010082 if (fuzzer->dynfileqCurrent == NULL) {
83 fuzzer->dynfileqCurrent = CIRCLEQ_FIRST(&hfuzz->dynfileq);
Robert Swiecki3bfc33c2016-03-14 18:12:41 +010084 }
Robert Swieckibf8f8cc2017-11-09 00:42:50 +010085
86 dynfile = fuzzer->dynfileqCurrent;
87 fuzzer->dynfileqCurrent
88 = CIRCLEQ_LOOP_NEXT(&hfuzz->dynfileq, fuzzer->dynfileqCurrent, pointers);
Robert Swiecki3bfc33c2016-03-14 18:12:41 +010089 }
90
91 memcpy(fuzzer->dynamicFile, dynfile->data, dynfile->size);
Robert Swieckia08ab1c2016-03-14 18:29:21 +010092 fuzzer->dynamicFileSz = dynfile->size;
Robert Swiecki3bfc33c2016-03-14 18:12:41 +010093
Robert Swieckia96d78d2016-03-14 16:50:50 +010094 mangle_mangleContent(hfuzz, fuzzer);
robert.swiecki@gmail.com6d6f7562015-02-17 22:18:51 +000095
Robert Swieckid0fa62c2017-09-28 18:11:05 +020096 if (hfuzz->persistent == false
97 && files_writeBufToFile(fuzzer->fileName, fuzzer->dynamicFile, fuzzer->dynamicFileSz,
Robert Swiecki4e595fb2017-10-11 17:26:51 +020098 O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC)
99 == false) {
Robert Swieckic8c32db2015-10-09 18:06:22 +0200100 LOG_E("Couldn't write buffer to file '%s'", fuzzer->fileName);
robert.swiecki@gmail.com3b6c6292015-02-26 11:48:46 +0000101 return false;
102 }
robert.swiecki@gmail.com6d6f7562015-02-17 22:18:51 +0000103
robert.swiecki@gmail.com6d6f7562015-02-17 22:18:51 +0000104 return true;
robert.swiecki@gmail.comd7aed312015-02-03 21:26:37 +0000105}
106
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200107static bool fuzz_prepareFile(honggfuzz_t* hfuzz, fuzzer_t* fuzzer, bool rewind)
robert.swiecki3bb518c2010-10-14 00:48:24 +0000108{
Robert Swiecki92a31362017-02-24 16:21:40 +0100109 char fname[PATH_MAX];
Robert Swiecki10eeb0a2017-09-28 15:42:52 +0200110 if (input_getNext(hfuzz, fname, rewind) == false) {
Robert Swiecki92a31362017-02-24 16:21:40 +0100111 return false;
112 }
113 fuzzer->origFileName = files_basename(fname);
Robert Swieckie8f8e8d2016-10-03 23:51:32 +0200114
Robert Swiecki92a31362017-02-24 16:21:40 +0100115 ssize_t fileSz = files_readFileToBufMax(fname, fuzzer->dynamicFile, hfuzz->maxFileSz);
Jagger1aa94d72016-04-02 02:37:35 +0200116 if (fileSz < 0) {
Robert Swiecki92a31362017-02-24 16:21:40 +0100117 LOG_E("Couldn't read contents of '%s'", fname);
robert.swiecki@gmail.combb5d2642015-02-25 20:00:00 +0000118 return false;
robert.swiecki3bb518c2010-10-14 00:48:24 +0000119 }
Robert Swieckia96d78d2016-03-14 16:50:50 +0100120 fuzzer->dynamicFileSz = fileSz;
robert.swiecki3bb518c2010-10-14 00:48:24 +0000121
Robert Swieckia438a522017-03-02 14:37:54 +0100122 mangle_mangleContent(hfuzz, fuzzer);
robert.swiecki@gmail.comc070b942015-02-25 18:29:19 +0000123
Robert Swieckid0fa62c2017-09-28 18:11:05 +0200124 if (hfuzz->persistent == false
125 && files_writeBufToFile(fuzzer->fileName, fuzzer->dynamicFile, fuzzer->dynamicFileSz,
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200126 O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC)
127 == false) {
Robert Swieckic8c32db2015-10-09 18:06:22 +0200128 LOG_E("Couldn't write buffer to file '%s'", fuzzer->fileName);
robert.swiecki@gmail.come7680522015-02-22 22:22:37 +0000129 return false;
130 }
131
robert.swiecki3bb518c2010-10-14 00:48:24 +0000132 return true;
133}
134
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200135static bool fuzz_prepareFileExternally(honggfuzz_t* hfuzz, fuzzer_t* fuzzer)
robert.swiecki3bb518c2010-10-14 00:48:24 +0000136{
Robert Swieckic1deec82017-04-27 02:42:12 +0200137 char fname[PATH_MAX];
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200138 if (input_getNext(hfuzz, fname, true /* rewind */)) {
Robert Swiecki5aff9c62017-04-27 12:06:02 +0200139 fuzzer->origFileName = files_basename(fname);
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200140 if (files_copyFile(fname, fuzzer->fileName, NULL, false /* try_link */) == false) {
Robert Swieckic1deec82017-04-27 02:42:12 +0200141 LOG_E("files_copyFile('%s', '%s')", fname, fuzzer->fileName);
142 return false;
143 }
Robert Swiecki87ca2112017-04-27 12:03:53 +0200144 } else {
Robert Swiecki5aff9c62017-04-27 12:06:02 +0200145 fuzzer->origFileName = "[EXTERNAL]";
Robert Swiecki69dff772017-06-04 23:11:14 +0200146 int dstfd = open(fuzzer->fileName, O_CREAT | O_TRUNC | O_RDWR | O_CLOEXEC, 0644);
Robert Swiecki87ca2112017-04-27 12:03:53 +0200147 if (dstfd == -1) {
148 PLOG_E("Couldn't create a temporary file '%s'", fuzzer->fileName);
149 return false;
150 }
151 close(dstfd);
Robert Swieckic1deec82017-04-27 02:42:12 +0200152 }
153
Jaggera34b3022016-04-02 02:20:40 +0200154 LOG_D("Created '%s' as an input file", fuzzer->fileName);
robert.swiecki3d505e22010-10-14 01:17:17 +0000155
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200156 const char* const argv[] = { hfuzz->externalCommand, fuzzer->fileName, NULL };
Robert Swiecki810d2c92017-06-01 21:37:27 +0200157 if (subproc_System(hfuzz, fuzzer, argv) != 0) {
Robert Swiecki54333cd2016-09-07 17:51:48 +0200158 LOG_E("Subprocess '%s' returned abnormally", hfuzz->externalCommand);
robert.swiecki3bb518c2010-10-14 00:48:24 +0000159 return false;
160 }
Robert Swiecki54333cd2016-09-07 17:51:48 +0200161 LOG_D("Subporcess '%s' finished with success", hfuzz->externalCommand);
Jagger1d743382016-04-02 02:09:41 +0200162
163 ssize_t rsz = files_readFileToBufMax(fuzzer->fileName, fuzzer->dynamicFile, hfuzz->maxFileSz);
Jagger1aa94d72016-04-02 02:37:35 +0200164 if (rsz < 0) {
Jagger1d743382016-04-02 02:09:41 +0200165 LOG_W("Couldn't read back '%s' to the buffer", fuzzer->fileName);
166 return false;
167 }
168 fuzzer->dynamicFileSz = rsz;
169
170 if (hfuzz->persistent) {
171 unlink(fuzzer->fileName);
172 }
173
174 return true;
robert.swiecki3bb518c2010-10-14 00:48:24 +0000175}
176
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200177static bool fuzz_postProcessFile(honggfuzz_t* hfuzz, fuzzer_t* fuzzer)
Robert Swieckiee266ac2016-10-03 02:25:59 +0200178{
Robert Swieckicc88f932017-07-07 00:13:00 +0200179 if (hfuzz->persistent) {
Robert Swieckid0fa62c2017-09-28 18:11:05 +0200180 if (files_writeBufToFile(fuzzer->fileName, fuzzer->dynamicFile, fuzzer->dynamicFileSz,
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200181 O_CREAT | O_TRUNC | O_WRONLY | O_CLOEXEC)
Robert Swieckid0fa62c2017-09-28 18:11:05 +0200182 == false) {
Robert Swieckicc88f932017-07-07 00:13:00 +0200183 LOG_E("Couldn't write file to '%s'", fuzzer->fileName);
184 return false;
185 }
Robert Swieckiee266ac2016-10-03 02:25:59 +0200186 }
187
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200188 const char* const argv[] = { hfuzz->postExternalCommand, fuzzer->fileName, NULL };
Robert Swiecki810d2c92017-06-01 21:37:27 +0200189 if (subproc_System(hfuzz, fuzzer, argv) != 0) {
Robert Swieckiee266ac2016-10-03 02:25:59 +0200190 LOG_E("Subprocess '%s' returned abnormally", hfuzz->postExternalCommand);
191 return false;
192 }
193 LOG_D("Subporcess '%s' finished with success", hfuzz->externalCommand);
194
195 ssize_t rsz = files_readFileToBufMax(fuzzer->fileName, fuzzer->dynamicFile, hfuzz->maxFileSz);
196 if (rsz < 0) {
197 LOG_W("Couldn't read back '%s' to the buffer", fuzzer->fileName);
198 return false;
199 }
200 fuzzer->dynamicFileSz = rsz;
201
202 return true;
203}
204
Robert Swiecki0b566112017-10-17 17:39:07 +0200205static fuzzState_t fuzz_getState(honggfuzz_t* hfuzz) { return ATOMIC_GET(hfuzz->state); }
Robert Swieckia7841da2017-02-24 17:27:06 +0100206
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200207static void fuzz_setState(honggfuzz_t* hfuzz, fuzzState_t state)
Robert Swieckia7841da2017-02-24 17:27:06 +0100208{
Robert Swiecki3915a812017-02-25 02:07:56 +0100209 /* All threads must indicate willingness to switch to _HF_STATE_DYNAMIC_MAIN */
210 if (state == _HF_STATE_DYNAMIC_MAIN) {
211 static size_t cnt = 0;
212 ATOMIC_PRE_INC(cnt);
213 while (ATOMIC_GET(cnt) < hfuzz->threadsMax) {
Robert Swiecki1a994732017-05-31 18:32:21 +0200214 if (ATOMIC_GET(hfuzz->terminating) == true) {
215 return;
216 }
Robert Swiecki3915a812017-02-25 02:07:56 +0100217 sleep(1);
218 }
219 }
220
Robert Swieckia7841da2017-02-24 17:27:06 +0100221 static pthread_mutex_t state_mutex = PTHREAD_MUTEX_INITIALIZER;
222 MX_SCOPED_LOCK(&state_mutex);
223
224 if (hfuzz->state == state) {
225 return;
226 }
227
228 switch (state) {
229 case _HF_STATE_DYNAMIC_PRE:
230 LOG_I("Entering phase 1/2: Dry Run");
231 break;
232 case _HF_STATE_DYNAMIC_MAIN:
233 LOG_I("Entering phase 2/2: Main");
234 break;
235 case _HF_STATE_STATIC:
236 LOG_I("Entering phase: Static");
237 break;
238 default:
239 LOG_I("Entering unknown phase: %d", state);
240 break;
241 }
242
243 ATOMIC_SET(hfuzz->state, state);
244}
245
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200246static bool fuzz_runVerifier(honggfuzz_t* hfuzz, fuzzer_t* crashedFuzzer)
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300247{
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300248 int crashFd = -1;
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200249 uint8_t* crashBuf = NULL;
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300250 off_t crashFileSz = 0;
251
252 crashBuf = files_mapFile(crashedFuzzer->crashFileName, &crashFileSz, &crashFd, false);
253 if (crashBuf == NULL) {
Anestis Bechtsoudis0cde66f2015-10-11 19:37:11 -0700254 LOG_E("Couldn't open and map '%s' in R/O mode", crashedFuzzer->crashFileName);
Robert Swieckie48811e2016-03-09 18:31:19 +0100255 return false;
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300256 }
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200257 defer
258 {
Jagger4fe18692016-04-22 23:15:07 +0200259 munmap(crashBuf, crashFileSz);
Jagger4fe18692016-04-22 23:15:07 +0200260 close(crashFd);
261 };
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300262
Anestis Bechtsoudis0cde66f2015-10-11 19:37:11 -0700263 LOG_I("Launching verifier for %" PRIx64 " hash", crashedFuzzer->backtrace);
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300264 for (int i = 0; i < _HF_VERIFIER_ITER; i++) {
265 fuzzer_t vFuzzer = {
266 .pid = 0,
Anestis Bechtsoudis92b97042016-04-27 12:34:19 +0300267 .persistentPid = 0,
Robert Swieckia7841da2017-02-24 17:27:06 +0100268 .state = fuzz_getState(hfuzz),
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300269 .timeStartedMillis = util_timeNowMillis(),
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200270 .crashFileName = { 0 },
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300271 .pc = 0ULL,
272 .backtrace = 0ULL,
273 .access = 0ULL,
274 .exception = 0,
Robert Swieckibf8f8cc2017-11-09 00:42:50 +0100275 .dynfileqCurrent = NULL,
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300276 .dynamicFileSz = 0,
277 .dynamicFile = NULL,
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200278 .sanCovCnts = {
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200279 .hitBBCnt = 0ULL,
280 .totalBBCnt = 0ULL,
281 .dsoCnt = 0ULL,
282 .iDsoCnt = 0ULL,
283 .newBBCnt = 0ULL,
284 .crashesCnt = 0ULL,
285 },
286 .report = { '\0' },
Jaggerb2c1fad2016-03-17 23:37:10 +0100287 .mainWorker = false,
Jaggerfa3544a2016-08-30 02:55:55 +0200288 .fuzzNo = crashedFuzzer->fuzzNo,
Jagger93253f72016-09-01 22:40:12 +0200289 .persistentSock = -1,
Robert Swiecki013bc9c2016-12-12 17:31:06 +0100290 .tmOutSignaled = false,
Jaggerb2c1fad2016-03-17 23:37:10 +0100291
Jagger2381ef42016-03-20 23:32:05 +0100292 .linux = {
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200293 .hwCnts = {
294 .cpuInstrCnt = 0ULL,
295 .cpuBranchCnt = 0ULL,
296 .bbCnt = 0ULL,
297 .newBBCnt = 0ULL,
298 .softCntPc = 0ULL,
299 .softCntEdge = 0ULL,
300 .softCntCmp = 0ULL,
301 },
302 .attachedPid = 0,
303 },
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300304 };
305
Anestis Bechtsoudis92b97042016-04-27 12:34:19 +0300306 if (arch_archThreadInit(hfuzz, &vFuzzer) == false) {
307 LOG_F("Could not initialize the thread");
308 }
309
Robert Swieckieaf27322017-06-01 21:49:26 +0200310 fuzz_getFileName(hfuzz, &vFuzzer);
Robert Swiecki0b566112017-10-17 17:39:07 +0200311 if (files_writeBufToFile(
312 vFuzzer.fileName, crashBuf, crashFileSz, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC)
Robert Swieckid0fa62c2017-09-28 18:11:05 +0200313 == false) {
Anestis Bechtsoudis0cde66f2015-10-11 19:37:11 -0700314 LOG_E("Couldn't write buffer to file '%s'", vFuzzer.fileName);
Robert Swieckie48811e2016-03-09 18:31:19 +0100315 return false;
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300316 }
317
Robert Swiecki940a0802016-11-02 12:42:09 +0100318 if (subproc_Run(hfuzz, &vFuzzer) == false) {
319 LOG_F("subproc_Run()");
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300320 }
Robert Swieckia8b8cb82016-08-17 18:27:08 +0200321
Anestis Bechtsoudis2b2a63b2016-12-28 15:34:40 +0200322 /* Delete intermediate files generated from verifier */
323 unlink(vFuzzer.fileName);
324
Anestis Bechtsoudisecb0a662015-09-27 18:19:46 +0300325 /* If stack hash doesn't match skip name tag and exit */
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300326 if (crashedFuzzer->backtrace != vFuzzer.backtrace) {
Anestis Bechtsoudis0cde66f2015-10-11 19:37:11 -0700327 LOG_D("Verifier stack hash mismatch");
Robert Swieckie48811e2016-03-09 18:31:19 +0100328 return false;
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300329 }
330 }
331
332 /* Workspace is inherited, just append a extra suffix */
333 char verFile[PATH_MAX] = { 0 };
334 snprintf(verFile, sizeof(verFile), "%s.verified", crashedFuzzer->crashFileName);
Anestis Bechtsoudisecb0a662015-09-27 18:19:46 +0300335
Anestis Bechtsoudisd86e6602015-11-07 18:34:06 +0200336 /* Copy file with new suffix & remove original copy */
337 bool dstFileExists = false;
Robert Swiecki0b566112017-10-17 17:39:07 +0200338 if (files_copyFile(
339 crashedFuzzer->crashFileName, verFile, &dstFileExists, true /* try_link */)) {
Anestis Bechtsoudisd86e6602015-11-07 18:34:06 +0200340 LOG_I("Successfully verified, saving as (%s)", verFile);
Jaggerd34417d2016-03-16 01:26:54 +0100341 ATOMIC_POST_INC(hfuzz->verifiedCrashesCnt);
Anestis Bechtsoudisd86e6602015-11-07 18:34:06 +0200342 unlink(crashedFuzzer->crashFileName);
343 } else {
344 if (dstFileExists) {
345 LOG_I("It seems that '%s' already exists, skipping", verFile);
346 } else {
347 LOG_E("Couldn't copy '%s' to '%s'", crashedFuzzer->crashFileName, verFile);
Robert Swieckie48811e2016-03-09 18:31:19 +0100348 return false;
Anestis Bechtsoudisd86e6602015-11-07 18:34:06 +0200349 }
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300350 }
Anestis Bechtsoudisecb0a662015-09-27 18:19:46 +0300351
Robert Swieckie48811e2016-03-09 18:31:19 +0100352 return true;
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300353}
354
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200355static void fuzz_addFileToFileQ(honggfuzz_t* hfuzz, fuzzer_t* fuzzer)
Robert Swieckif3534bb2016-03-14 18:55:10 +0100356{
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200357 struct dynfile_t* dynfile = (struct dynfile_t*)util_Malloc(sizeof(struct dynfile_t));
Robert Swieckie6a4ff32017-02-24 17:07:05 +0100358 dynfile->size = fuzzer->dynamicFileSz;
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200359 dynfile->data = (uint8_t*)util_Malloc(fuzzer->dynamicFileSz);
Robert Swieckie6a4ff32017-02-24 17:07:05 +0100360 memcpy(dynfile->data, fuzzer->dynamicFile, fuzzer->dynamicFileSz);
Robert Swiecki37498fd2017-03-12 21:12:54 +0100361
Robert Swieckibf8f8cc2017-11-09 00:42:50 +0100362 MX_SCOPED_RWLOCK_WRITE(&hfuzz->dynfileq_mutex);
363 CIRCLEQ_INSERT_TAIL(&hfuzz->dynfileq, dynfile, pointers);
Robert Swieckif3534bb2016-03-14 18:55:10 +0100364 hfuzz->dynfileqCnt++;
365
Jagger3c7e7ce2016-09-25 16:05:19 +0200366 /* No need to add new coverage if we are supposed to append new coverage-inducing inputs only */
Robert Swieckie6a4ff32017-02-24 17:07:05 +0100367 if (fuzzer->state == _HF_STATE_DYNAMIC_PRE && hfuzz->covDir == NULL) {
Jagger1b2d4822016-09-25 16:19:45 +0200368 LOG_D("New coverage found, but we're in the initial coverage assessment state. Skipping");
Jagger3c7e7ce2016-09-25 16:05:19 +0200369 return;
370 }
371
Robert Swieckif3534bb2016-03-14 18:55:10 +0100372 char fname[PATH_MAX];
Robert Swieckie6a4ff32017-02-24 17:07:05 +0100373 uint64_t crc64f = util_CRC64(fuzzer->dynamicFile, fuzzer->dynamicFileSz);
374 uint64_t crc64r = util_CRC64Rev(fuzzer->dynamicFile, fuzzer->dynamicFileSz);
Robert Swieckifd02b692017-02-22 02:33:27 +0100375 snprintf(fname, sizeof(fname), "%s/%016" PRIx64 "%016" PRIx64 ".%08" PRIx32 ".honggfuzz.cov",
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200376 hfuzz->covDir ? hfuzz->covDir : hfuzz->inputDir, crc64f, crc64r,
377 (uint32_t)fuzzer->dynamicFileSz);
Jagger3c7e7ce2016-09-25 16:05:19 +0200378
Robert Swiecki22f6bef2017-01-31 01:45:26 +0100379 if (access(fname, R_OK) == 0) {
380 LOG_D("File '%s' already exists in the corpus directory", fname);
381 return;
382 }
383
384 LOG_D("Adding file '%s' to the corpus directory", fname);
385
Robert Swieckid0fa62c2017-09-28 18:11:05 +0200386 if (files_writeBufToFile(fname, fuzzer->dynamicFile, fuzzer->dynamicFileSz,
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200387 O_WRONLY | O_CREAT | O_EXCL | O_TRUNC | O_CLOEXEC)
Jagger33cce5d2016-04-16 20:10:36 +0200388 == false) {
Robert Swieckif3534bb2016-03-14 18:55:10 +0100389 LOG_W("Couldn't write buffer to file '%s'", fname);
390 }
391}
392
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200393static void fuzz_perfFeedback(honggfuzz_t* hfuzz, fuzzer_t* fuzzer)
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200394{
Robert Swiecki53ec9e42017-02-15 20:34:27 +0100395 if (hfuzz->skipFeedbackOnTimeout && fuzzer->tmOutSignaled) {
396 return;
397 }
398
Robert Swiecki0b566112017-10-17 17:39:07 +0200399 LOG_D("New file size: %zu, Perf feedback new/cur (instr,branch): %" PRIu64 "/%" PRIu64
400 "/%" PRIu64 "/%" PRIu64 ", BBcnt new/total: %" PRIu64 "/%" PRIu64,
401 fuzzer->dynamicFileSz, fuzzer->linux.hwCnts.cpuInstrCnt, hfuzz->linux.hwCnts.cpuInstrCnt,
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200402 fuzzer->linux.hwCnts.cpuBranchCnt, hfuzz->linux.hwCnts.cpuBranchCnt,
403 fuzzer->linux.hwCnts.newBBCnt, hfuzz->linux.hwCnts.bbCnt);
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200404
Robert Swiecki37498fd2017-03-12 21:12:54 +0100405 MX_SCOPED_LOCK(&hfuzz->feedback_mutex);
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200406
Jagger34789a72016-09-08 00:36:09 +0200407 uint64_t softCntPc = 0UL;
Robert Swieckib27c8952017-05-23 23:38:04 +0200408 uint64_t softCntEdge = 0UL;
Jagger34789a72016-09-08 00:36:09 +0200409 uint64_t softCntCmp = 0UL;
Jagger251d0192016-08-24 00:54:04 +0200410 if (hfuzz->bbFd != -1) {
Jagger34789a72016-09-08 00:36:09 +0200411 softCntPc = ATOMIC_GET(hfuzz->feedback->pidFeedbackPc[fuzzer->fuzzNo]);
412 ATOMIC_CLEAR(hfuzz->feedback->pidFeedbackPc[fuzzer->fuzzNo]);
Robert Swieckib27c8952017-05-23 23:38:04 +0200413 softCntEdge = ATOMIC_GET(hfuzz->feedback->pidFeedbackEdge[fuzzer->fuzzNo]);
414 ATOMIC_CLEAR(hfuzz->feedback->pidFeedbackEdge[fuzzer->fuzzNo]);
Jagger34789a72016-09-08 00:36:09 +0200415 softCntCmp = ATOMIC_GET(hfuzz->feedback->pidFeedbackCmp[fuzzer->fuzzNo]);
416 ATOMIC_CLEAR(hfuzz->feedback->pidFeedbackCmp[fuzzer->fuzzNo]);
Jagger251d0192016-08-24 00:54:04 +0200417 }
Jaggerb01aaae2016-08-20 03:35:38 +0200418
Jagger302c2ea2016-09-07 03:54:43 +0200419 int64_t diff0 = hfuzz->linux.hwCnts.cpuInstrCnt - fuzzer->linux.hwCnts.cpuInstrCnt;
420 int64_t diff1 = hfuzz->linux.hwCnts.cpuBranchCnt - fuzzer->linux.hwCnts.cpuBranchCnt;
Jagger302c2ea2016-09-07 03:54:43 +0200421
Jagger8d0002c2016-08-17 03:44:23 +0200422 /*
423 * Coverage is the primary counter, the rest is secondary, and taken into consideration only
424 * if the coverage counter has not been changed
425 */
Robert Swieckib27c8952017-05-23 23:38:04 +0200426 if (fuzzer->linux.hwCnts.newBBCnt > 0 || softCntPc > 0 || softCntEdge > 0 || softCntCmp > 0
427 || diff0 < 0 || diff1 < 0) {
Robert Swiecki92ec8d22016-11-21 01:10:18 +0100428
429 if (diff0 < 0) {
430 hfuzz->linux.hwCnts.cpuInstrCnt = fuzzer->linux.hwCnts.cpuInstrCnt;
431 }
432 if (diff1 < 0) {
433 hfuzz->linux.hwCnts.cpuBranchCnt = fuzzer->linux.hwCnts.cpuBranchCnt;
434 }
Jagger247c3b42016-03-21 23:24:05 +0100435 hfuzz->linux.hwCnts.bbCnt += fuzzer->linux.hwCnts.newBBCnt;
Jagger34789a72016-09-08 00:36:09 +0200436 hfuzz->linux.hwCnts.softCntPc += softCntPc;
Robert Swieckib27c8952017-05-23 23:38:04 +0200437 hfuzz->linux.hwCnts.softCntEdge += softCntEdge;
Jagger34789a72016-09-08 00:36:09 +0200438 hfuzz->linux.hwCnts.softCntCmp += softCntCmp;
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200439
Robert Swiecki0b566112017-10-17 17:39:07 +0200440 LOG_I("Size:%zu (i,b,edg,ip,hw,cmp): %" PRIu64 "/%" PRIu64 "/%" PRIu64 "/%" PRIu64
441 "/%" PRIu64 "/%" PRIu64 ", Tot:%" PRIu64 "/%" PRIu64 "/%" PRIu64 "/%" PRIu64
442 "/%" PRIu64 "/%" PRIu64,
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200443 fuzzer->dynamicFileSz, fuzzer->linux.hwCnts.cpuInstrCnt,
444 fuzzer->linux.hwCnts.cpuBranchCnt, softCntEdge, softCntPc,
445 fuzzer->linux.hwCnts.newBBCnt, softCntCmp, hfuzz->linux.hwCnts.cpuInstrCnt,
446 hfuzz->linux.hwCnts.cpuBranchCnt, hfuzz->linux.hwCnts.softCntEdge,
447 hfuzz->linux.hwCnts.softCntPc, hfuzz->linux.hwCnts.bbCnt,
448 hfuzz->linux.hwCnts.softCntCmp);
Jagger395df022016-08-21 01:13:25 +0200449
Robert Swiecki37498fd2017-03-12 21:12:54 +0100450 fuzz_addFileToFileQ(hfuzz, fuzzer);
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200451 }
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200452}
453
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200454static void fuzz_sanCovFeedback(honggfuzz_t* hfuzz, fuzzer_t* fuzzer)
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200455{
Robert Swiecki53ec9e42017-02-15 20:34:27 +0100456 if (hfuzz->skipFeedbackOnTimeout && fuzzer->tmOutSignaled) {
457 return;
458 }
459
Robert Swiecki0b566112017-10-17 17:39:07 +0200460 LOG_D("File size (Best/New): %zu, SanCov feedback (bb,dso): Best: [%" PRIu64 ",%" PRIu64
461 "] / New: [%" PRIu64 ",%" PRIu64 "], newBBs:%" PRIu64,
462 fuzzer->dynamicFileSz, hfuzz->sanCovCnts.hitBBCnt, hfuzz->sanCovCnts.iDsoCnt,
463 fuzzer->sanCovCnts.hitBBCnt, fuzzer->sanCovCnts.iDsoCnt, fuzzer->sanCovCnts.newBBCnt);
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200464
Robert Swiecki37498fd2017-03-12 21:12:54 +0100465 MX_SCOPED_LOCK(&hfuzz->feedback_mutex);
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200466
Jaggerd5738372016-08-17 20:12:15 +0200467 int64_t diff0 = hfuzz->linux.hwCnts.cpuInstrCnt - fuzzer->linux.hwCnts.cpuInstrCnt;
468 int64_t diff1 = hfuzz->linux.hwCnts.cpuBranchCnt - fuzzer->linux.hwCnts.cpuBranchCnt;
Jaggerd5738372016-08-17 20:12:15 +0200469
Anestis Bechtsoudisa16f70f2016-01-03 13:03:21 +0200470 /*
471 * Keep mutated seed if:
Robert Swiecki142f9412016-03-14 19:22:01 +0100472 * a) Newly discovered (not met before) BBs
473 * b) More instrumented DSOs loaded
Robert Swiecki23ec02a2016-01-19 18:47:45 +0100474 *
Anestis Bechtsoudisb78cf602016-01-07 13:10:50 +0200475 * TODO: (a) method can significantly assist to further improvements in interesting areas
Anestis Bechtsoudisa16f70f2016-01-03 13:03:21 +0200476 * discovery if combined with seeds pool/queue support. If a runtime queue is maintained
477 * more interesting seeds can be saved between runs instead of instantly discarded
478 * based on current absolute elitism (only one mutated seed is promoted).
479 */
Jaggerd5738372016-08-17 20:12:15 +0200480
481 bool newCov = (fuzzer->sanCovCnts.newBBCnt > 0
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200482 || hfuzz->sanCovCnts.iDsoCnt < fuzzer->sanCovCnts.iDsoCnt);
Jaggerd5738372016-08-17 20:12:15 +0200483
Robert Swieckid158aac2016-11-01 23:14:12 +0100484 if (newCov || (diff0 < 0 || diff1 < 0)) {
Robert Swiecki0b566112017-10-17 17:39:07 +0200485 LOG_I("SanCov Update: fsize:%zu, newBBs:%" PRIu64 ", (Cur,New): %" PRIu64 "/%" PRIu64
486 ",%" PRIu64 "/%" PRIu64,
487 fuzzer->dynamicFileSz, fuzzer->sanCovCnts.newBBCnt, hfuzz->sanCovCnts.hitBBCnt,
488 hfuzz->sanCovCnts.iDsoCnt, fuzzer->sanCovCnts.hitBBCnt, fuzzer->sanCovCnts.iDsoCnt);
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200489
Robert Swiecki142f9412016-03-14 19:22:01 +0100490 hfuzz->sanCovCnts.hitBBCnt += fuzzer->sanCovCnts.newBBCnt;
Anestis Bechtsoudisa16f70f2016-01-03 13:03:21 +0200491 hfuzz->sanCovCnts.dsoCnt = fuzzer->sanCovCnts.dsoCnt;
492 hfuzz->sanCovCnts.iDsoCnt = fuzzer->sanCovCnts.iDsoCnt;
493 hfuzz->sanCovCnts.crashesCnt += fuzzer->sanCovCnts.crashesCnt;
Robert Swiecki142f9412016-03-14 19:22:01 +0100494 hfuzz->sanCovCnts.newBBCnt = fuzzer->sanCovCnts.newBBCnt;
Anestis Bechtsoudisb78cf602016-01-07 13:10:50 +0200495
Anestis Bechtsoudis56e360f2016-01-11 14:29:17 +0200496 if (hfuzz->sanCovCnts.totalBBCnt < fuzzer->sanCovCnts.totalBBCnt) {
Anestis Bechtsoudisa16f70f2016-01-03 13:03:21 +0200497 /* Keep only the max value (for dlopen cases) to measure total target coverage */
Anestis Bechtsoudis56e360f2016-01-11 14:29:17 +0200498 hfuzz->sanCovCnts.totalBBCnt = fuzzer->sanCovCnts.totalBBCnt;
Anestis Bechtsoudisa16f70f2016-01-03 13:03:21 +0200499 }
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200500
Jaggerd5738372016-08-17 20:12:15 +0200501 hfuzz->linux.hwCnts.cpuInstrCnt = fuzzer->linux.hwCnts.cpuInstrCnt;
502 hfuzz->linux.hwCnts.cpuBranchCnt = fuzzer->linux.hwCnts.cpuBranchCnt;
Jaggerd5738372016-08-17 20:12:15 +0200503
Robert Swiecki37498fd2017-03-12 21:12:54 +0100504 fuzz_addFileToFileQ(hfuzz, fuzzer);
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200505 }
Anestis Bechtsoudisbe0ac7b2015-12-26 15:38:47 +0200506}
507
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200508static void fuzz_fuzzLoop(honggfuzz_t* hfuzz, fuzzer_t* fuzzer)
Jagger190f0dc2015-09-05 16:41:22 +0200509{
Robert Swieckidecf14b2016-03-31 15:09:28 +0200510 fuzzer->pid = 0;
511 fuzzer->timeStartedMillis = util_timeNowMillis();
Robert Swieckie6a4ff32017-02-24 17:07:05 +0100512 fuzzer->state = fuzz_getState(hfuzz);
Robert Swieckidecf14b2016-03-31 15:09:28 +0200513 fuzzer->crashFileName[0] = '\0';
514 fuzzer->pc = 0ULL;
515 fuzzer->backtrace = 0ULL;
516 fuzzer->access = 0ULL;
517 fuzzer->exception = 0;
518 fuzzer->report[0] = '\0';
519 fuzzer->mainWorker = true;
520 fuzzer->origFileName = "DYNAMIC";
Robert Swiecki10e93562017-11-04 00:57:47 +0100521 fuzzer->mutationsPerRun = hfuzz->mutationsPerRun;
Robert Swieckidecf14b2016-03-31 15:09:28 +0200522 fuzzer->dynamicFileSz = 0;
Robert Swieckia96d78d2016-03-14 16:50:50 +0100523
Robert Swieckidecf14b2016-03-31 15:09:28 +0200524 fuzzer->sanCovCnts.hitBBCnt = 0ULL;
525 fuzzer->sanCovCnts.totalBBCnt = 0ULL;
526 fuzzer->sanCovCnts.dsoCnt = 0ULL;
527 fuzzer->sanCovCnts.newBBCnt = 0ULL;
528 fuzzer->sanCovCnts.crashesCnt = 0ULL;
Robert Swieckia96d78d2016-03-14 16:50:50 +0100529
Robert Swieckidecf14b2016-03-31 15:09:28 +0200530 fuzzer->linux.hwCnts.cpuInstrCnt = 0ULL;
531 fuzzer->linux.hwCnts.cpuBranchCnt = 0ULL;
Robert Swieckidecf14b2016-03-31 15:09:28 +0200532 fuzzer->linux.hwCnts.bbCnt = 0ULL;
533 fuzzer->linux.hwCnts.newBBCnt = 0ULL;
Jagger190f0dc2015-09-05 16:41:22 +0200534
Robert Swieckie6a4ff32017-02-24 17:07:05 +0100535 if (fuzzer->state == _HF_STATE_DYNAMIC_PRE) {
Robert Swiecki10e93562017-11-04 00:57:47 +0100536 fuzzer->mutationsPerRun = 0U;
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200537 if (fuzz_prepareFile(hfuzz, fuzzer, false /* rewind */) == false) {
Robert Swieckicc88f932017-07-07 00:13:00 +0200538 fuzz_setState(hfuzz, _HF_STATE_DYNAMIC_MAIN);
539 fuzzer->state = fuzz_getState(hfuzz);
Robert Swieckiee266ac2016-10-03 02:25:59 +0200540 }
Robert Swiecki92a31362017-02-24 16:21:40 +0100541 }
Robert Swiecki1a994732017-05-31 18:32:21 +0200542
543 if (ATOMIC_GET(hfuzz->terminating) == true) {
544 return;
545 }
546
Robert Swieckie6a4ff32017-02-24 17:07:05 +0100547 if (fuzzer->state == _HF_STATE_DYNAMIC_MAIN) {
Robert Swieckicc88f932017-07-07 00:13:00 +0200548 if (hfuzz->externalCommand) {
549 if (!fuzz_prepareFileExternally(hfuzz, fuzzer)) {
550 LOG_F("fuzz_prepareFileExternally() failed");
551 }
552 } else if (!fuzz_prepareFileDynamically(hfuzz, fuzzer)) {
Jagger1d8e0c62016-04-02 02:22:40 +0200553 LOG_F("fuzz_prepareFileDynamically() failed");
Robert Swieckia96d78d2016-03-14 16:50:50 +0100554 }
Robert Swieckicc88f932017-07-07 00:13:00 +0200555
556 if (hfuzz->postExternalCommand) {
557 if (!fuzz_postProcessFile(hfuzz, fuzzer)) {
558 LOG_F("fuzz_postProcessFile() failed");
559 }
560 }
Jagger190f0dc2015-09-05 16:41:22 +0200561 }
Robert Swieckicc88f932017-07-07 00:13:00 +0200562
Robert Swieckie6a4ff32017-02-24 17:07:05 +0100563 if (fuzzer->state == _HF_STATE_STATIC) {
Robert Swiecki92a31362017-02-24 16:21:40 +0100564 if (hfuzz->externalCommand) {
565 if (!fuzz_prepareFileExternally(hfuzz, fuzzer)) {
566 LOG_F("fuzz_prepareFileExternally() failed");
567 }
568 } else {
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200569 if (!fuzz_prepareFile(hfuzz, fuzzer, true /* rewind */)) {
Robert Swiecki92a31362017-02-24 16:21:40 +0100570 LOG_F("fuzz_prepareFile() failed");
571 }
572 }
Robert Swieckiab2b8c92017-07-07 12:55:43 +0200573
Robert Swiecki92a31362017-02-24 16:21:40 +0100574 if (hfuzz->postExternalCommand != NULL) {
575 if (!fuzz_postProcessFile(hfuzz, fuzzer)) {
576 LOG_F("fuzz_postProcessFile() failed");
577 }
Robert Swieckiee266ac2016-10-03 02:25:59 +0200578 }
579 }
580
Robert Swiecki940a0802016-11-02 12:42:09 +0100581 if (subproc_Run(hfuzz, fuzzer) == false) {
582 LOG_F("subproc_Run()");
Jagger190f0dc2015-09-05 16:41:22 +0200583 }
584
Jaggera34b3022016-04-02 02:20:40 +0200585 if (hfuzz->persistent == false) {
586 unlink(fuzzer->fileName);
587 }
Jagger190f0dc2015-09-05 16:41:22 +0200588
Robert Swiecki53ec9e42017-02-15 20:34:27 +0100589 if (hfuzz->dynFileMethod != _HF_DYNFILE_NONE) {
590 fuzz_perfFeedback(hfuzz, fuzzer);
591 }
592 if (hfuzz->useSanCov) {
593 fuzz_sanCovFeedback(hfuzz, fuzzer);
Robert Swiecki0f937af2016-03-30 18:19:16 +0200594 }
Jagger190f0dc2015-09-05 16:41:22 +0200595
Robert Swieckidecf14b2016-03-31 15:09:28 +0200596 if (hfuzz->useVerifier && (fuzzer->crashFileName[0] != 0) && fuzzer->backtrace) {
597 if (!fuzz_runVerifier(hfuzz, fuzzer)) {
598 LOG_I("Failed to verify %s", fuzzer->crashFileName);
Anestis Bechtsoudis3085f222015-09-27 18:35:26 +0300599 }
Anestis Bechtsoudis5c86ebc2015-09-27 18:06:43 +0300600 }
601
Robert Swiecki216fef62016-10-20 18:32:58 +0200602 report_Report(hfuzz, fuzzer->report);
Jagger190f0dc2015-09-05 16:41:22 +0200603}
604
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200605static void* fuzz_threadNew(void* arg)
robert.swiecki3bb518c2010-10-14 00:48:24 +0000606{
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200607 honggfuzz_t* hfuzz = (honggfuzz_t*)arg;
Robert Swiecki0ec98112017-02-03 02:08:14 +0100608 unsigned int fuzzNo = ATOMIC_POST_INC(hfuzz->threadsActiveCnt);
609 LOG_I("Launched new fuzzing thread, no. #%" PRId32, fuzzNo);
Anestis Bechtsoudis02b99be2015-12-27 11:53:01 +0200610
Robert Swieckidecf14b2016-03-31 15:09:28 +0200611 fuzzer_t fuzzer = {
612 .pid = 0,
613 .persistentPid = 0,
Robert Swieckibf8f8cc2017-11-09 00:42:50 +0100614 .dynfileqCurrent = NULL,
Robert Swiecki147d4672017-01-29 02:49:06 +0100615 .dynamicFile = util_Calloc(hfuzz->maxFileSz),
Jaggerfa3544a2016-08-30 02:55:55 +0200616 .fuzzNo = fuzzNo,
Jagger93253f72016-09-01 22:40:12 +0200617 .persistentSock = -1,
Robert Swiecki013bc9c2016-12-12 17:31:06 +0100618 .tmOutSignaled = false,
Robert Swiecki47f5de12017-03-28 03:25:55 +0200619 .fileName = "[UNSET]",
Robert Swiecki12800cd2016-03-31 15:38:10 +0200620
Robert Swieckib692f282016-08-25 16:21:08 +0200621 .linux.attachedPid = 0,
Robert Swieckidecf14b2016-03-31 15:09:28 +0200622 };
Robert Swiecki0b566112017-10-17 17:39:07 +0200623 defer { free(fuzzer.dynamicFile); };
Robert Swiecki2b3ecfe2017-06-05 20:43:50 +0200624 fuzz_getFileName(hfuzz, &fuzzer);
Robert Swieckidecf14b2016-03-31 15:09:28 +0200625
626 if (arch_archThreadInit(hfuzz, &fuzzer) == false) {
Robert Swiecki0f937af2016-03-30 18:19:16 +0200627 LOG_F("Could not initialize the thread");
628 }
629
Robert Swieckia96d78d2016-03-14 16:50:50 +0100630 for (;;) {
Anestis Bechtsoudis46ea10e2015-11-07 18:16:25 +0200631 /* Check if dry run mode with verifier enabled */
Robert Swiecki10e93562017-11-04 00:57:47 +0100632 if (hfuzz->mutationsPerRun == 0U && hfuzz->useVerifier) {
Jaggerd34417d2016-03-16 01:26:54 +0100633 if (ATOMIC_POST_INC(hfuzz->mutationsCnt) >= hfuzz->fileCnt) {
634 ATOMIC_POST_INC(hfuzz->threadsFinished);
Robert Swiecki069b48f2017-05-31 01:00:08 +0200635 break;
Anestis Bechtsoudis46ea10e2015-11-07 18:16:25 +0200636 }
637 }
638 /* Check for max iterations limit if set */
Jaggerd34417d2016-03-16 01:26:54 +0100639 else if ((ATOMIC_POST_INC(hfuzz->mutationsCnt) >= hfuzz->mutationsMax)
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200640 && hfuzz->mutationsMax) {
Jaggerd34417d2016-03-16 01:26:54 +0100641 ATOMIC_POST_INC(hfuzz->threadsFinished);
Robert Swiecki069b48f2017-05-31 01:00:08 +0200642 break;
Robert Swiecki8d01b012017-02-19 15:48:11 +0100643 }
644
Robert Swieckidecf14b2016-03-31 15:09:28 +0200645 fuzz_fuzzLoop(hfuzz, &fuzzer);
Robert Swiecki069b48f2017-05-31 01:00:08 +0200646
647 if (ATOMIC_GET(hfuzz->terminating) == true) {
648 break;
649 }
650
651 if (hfuzz->exitUponCrash && ATOMIC_GET(hfuzz->crashesCnt) > 0) {
652 LOG_I("Seen a crash. Terminating all fuzzing threads");
653 ATOMIC_SET(hfuzz->terminating, true);
654 break;
655 }
robert.swiecki@gmail.comd4dd4df2015-02-18 00:50:12 +0000656 }
Robert Swiecki069b48f2017-05-31 01:00:08 +0200657
658 LOG_I("Terminating thread no. #%" PRId32, fuzzNo);
659 ATOMIC_POST_INC(hfuzz->threadsFinished);
Robert Swieckiaa623952017-06-01 02:50:41 +0200660 pthread_kill(fuzz_mainThread, SIGALRM);
Robert Swiecki069b48f2017-05-31 01:00:08 +0200661 return NULL;
robert.swiecki@gmail.com882900b2015-02-11 13:56:22 +0000662}
663
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200664static void fuzz_runThread(honggfuzz_t* hfuzz, pthread_t* thread, void* (*thread_func)(void*))
robert.swiecki@gmail.comc8443142015-02-13 13:46:40 +0000665{
robert.swiecki@gmail.comc8443142015-02-13 13:46:40 +0000666 pthread_attr_t attr;
robert.swiecki@gmail.comc8443142015-02-13 13:46:40 +0000667
robert.swiecki@gmail.com6f5c2392015-02-16 18:13:09 +0000668 pthread_attr_init(&attr);
Robert Swiecki33fb2842017-02-19 05:39:50 +0100669 pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_JOINABLE);
robert.swiecki@gmail.com441089a2015-02-23 13:14:07 +0000670 pthread_attr_setstacksize(&attr, _HF_PTHREAD_STACKSIZE);
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200671 pthread_attr_setguardsize(&attr, (size_t)sysconf(_SC_PAGESIZE));
robert.swiecki@gmail.comc8443142015-02-13 13:46:40 +0000672
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200673 if (pthread_create(thread, &attr, thread_func, (void*)hfuzz) < 0) {
Robert Swieckic8c32db2015-10-09 18:06:22 +0200674 PLOG_F("Couldn't create a new thread");
robert.swiecki@gmail.comc8443142015-02-13 13:46:40 +0000675 }
676
Robert Swiecki33fb2842017-02-19 05:39:50 +0100677 pthread_attr_destroy(&attr);
678
robert.swiecki@gmail.comc8443142015-02-13 13:46:40 +0000679 return;
680}
681
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200682void fuzz_threadsStart(honggfuzz_t* hfuzz, pthread_t* threads)
robert.swiecki3bb518c2010-10-14 00:48:24 +0000683{
Jagger6113c432015-09-24 05:00:28 +0200684 fuzz_mainThread = pthread_self();
685
robert.swiecki@gmail.com956276a2015-04-16 16:51:52 +0000686 if (!arch_archInit(hfuzz)) {
Robert Swieckic8c32db2015-10-09 18:06:22 +0200687 LOG_F("Couldn't prepare arch for fuzzing");
robert.swiecki@gmail.comef829fa2011-06-22 13:51:57 +0000688 }
Anestis Bechtsoudise5f09f82016-12-27 16:06:05 +0200689 if (!sanitizers_Init(hfuzz)) {
690 LOG_F("Couldn't prepare sanitizer options");
691 }
Jagger00265602016-03-10 02:36:27 +0100692 if (!sancov_Init(hfuzz)) {
693 LOG_F("Couldn't prepare sancov options");
694 }
robert.swiecki@gmail.comef829fa2011-06-22 13:51:57 +0000695
Robert Swieckia96d78d2016-03-14 16:50:50 +0100696 if (hfuzz->useSanCov || hfuzz->dynFileMethod != _HF_DYNFILE_NONE) {
Jaggerebe19292016-03-17 00:11:44 +0100697 fuzz_setState(hfuzz, _HF_STATE_DYNAMIC_PRE);
Robert Swieckia96d78d2016-03-14 16:50:50 +0100698 } else {
Jaggerebe19292016-03-17 00:11:44 +0100699 fuzz_setState(hfuzz, _HF_STATE_STATIC);
Robert Swieckia96d78d2016-03-14 16:50:50 +0100700 }
701
Jaggerea39a8f2015-09-05 00:57:22 +0200702 for (size_t i = 0; i < hfuzz->threadsMax; i++) {
Robert Swiecki33fb2842017-02-19 05:39:50 +0100703 fuzz_runThread(hfuzz, &threads[i], fuzz_threadNew);
robert.swiecki3bb518c2010-10-14 00:48:24 +0000704 }
robert.swiecki3bb518c2010-10-14 00:48:24 +0000705}
Robert Swiecki33fb2842017-02-19 05:39:50 +0100706
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200707void fuzz_threadsStop(honggfuzz_t* hfuzz, pthread_t* threads)
Robert Swiecki33fb2842017-02-19 05:39:50 +0100708{
709 for (size_t i = 0; i < hfuzz->threadsMax; i++) {
Robert Swiecki4e595fb2017-10-11 17:26:51 +0200710 void* retval;
Robert Swiecki33fb2842017-02-19 05:39:50 +0100711 if (pthread_join(threads[i], &retval) != 0) {
712 PLOG_F("Couldn't pthread_join() thread: %zu", i);
713 }
714 }
715 LOG_I("All threads done");
716}