Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 1 | /* |
| 2 | * |
| 3 | * honggfuzz - sanitizer coverage feedback parsing |
| 4 | * ----------------------------------------------- |
| 5 | * |
| 6 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 7 | * not use this file except in compliance with the License. You may obtain |
| 8 | * a copy of the License at |
| 9 | * |
| 10 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 11 | * |
| 12 | * Unless required by applicable law or agreed to in writing, software |
| 13 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 14 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or |
| 15 | * implied. See the License for the specific language governing |
| 16 | * permissions and limitations under the License. |
| 17 | * |
| 18 | */ |
| 19 | |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 20 | /* |
| 21 | * Clang sanitizer coverage (sancov) data parsing functions. Supported methods: |
| 22 | * - raw unified data (preferred method) |
| 23 | * - individual data per executable/DSO (not preferred since lots of data lost if instrumented |
| 24 | * code exits abnormally or with sanitizer unhandled signal (common in Android OS) |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 25 | * |
| 26 | * For raw-unpack method a global (shared across workers) Trie is created for the chosen |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 27 | * initial seed and maintained until seed is replaced. Trie nodes store the loaded (as exposed |
| 28 | * from *.sancov.map file) execs/DSOs from target application using the map name as key. Trie node |
| 29 | * data struct (trieData_t) maintains information for each instrumented map including a bitmap with |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 30 | * all hit relative BB addresses (realBBAddr - baseAddr to circumvent ASLR). Map's bitmap is updated while |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 31 | * new areas on target application are discovered based on absolute elitism implemented at |
| 32 | * fuzz_sanCovFeedback(). |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 33 | * |
Anestis Bechtsoudis | a7c56ce | 2016-02-07 12:53:20 +0200 | [diff] [blame] | 34 | * For individual data files a pid (fuzzer's thread or remote process) based filename search is performed |
| 35 | * to identify all files belonging to examined execution. This method doesn't implement yet bitmap runtime |
| 36 | * data to detect newly discovered areas. It's mainly used so far as a comparison metric for raw-unpack method |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 37 | * and stability check for sancov experimental features such as coverage counters: |
| 38 | * http://clang.llvm.org/docs/SanitizerCoverage.html |
| 39 | */ |
| 40 | |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 41 | #include "common.h" |
| 42 | #include "sancov.h" |
| 43 | |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 44 | #include <ctype.h> |
Jagger | 0026560 | 2016-03-10 02:36:27 +0100 | [diff] [blame] | 45 | #include <dirent.h> |
| 46 | #include <inttypes.h> |
| 47 | #include <stdio.h> |
| 48 | #include <stdlib.h> |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 49 | #include <string.h> |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 50 | #include <sys/mman.h> |
Jagger | 0026560 | 2016-03-10 02:36:27 +0100 | [diff] [blame] | 51 | #include <sys/stat.h> |
| 52 | #include <sys/types.h> |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 53 | |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 54 | #include "files.h" |
| 55 | #include "log.h" |
Jagger | 0026560 | 2016-03-10 02:36:27 +0100 | [diff] [blame] | 56 | #include "util.h" |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 57 | |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 58 | /* sancov files magic values */ |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 59 | #define kMagic32 0xC0BFFFFFFFFFFF32 |
| 60 | #define kMagic64 0xC0BFFFFFFFFFFF64 |
| 61 | |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 62 | /* |
Anestis Bechtsoudis | 0ddd078 | 2016-12-28 18:33:28 +0200 | [diff] [blame] | 63 | * Each DSO/executable that has been compiled with enabled coverage instrumentation |
| 64 | * is detected from compiler_rt runtime library when loaded. When coverage_direct |
| 65 | * method is selected, runtime library is pre-allocating kPcArrayMmapSize [1] byte |
| 66 | * chunks until the total size of chunks is greater than the number of inserted |
| 67 | * guards. This effectively means that we might have a large unused (zero-filled) |
| 68 | * area that we can't identify at runtime (we need to do binary inspection). |
| 69 | * |
| 70 | * Runtime maintained data structs size overhead is not affected since fixed-size |
| 71 | * bitmap is used. However, the way the display coverage statistics are generated |
| 72 | * is not very accurate because: |
| 73 | * a) ASan compiled DSO might get loaded although not followed from monitoring |
| 74 | execution affecting the counters |
| 75 | * b) Not all zero-fill chunks translate into non-hit basic block as they might |
| 76 | * be the chunk padding |
| 77 | * |
| 78 | * Probably there aren't many we can do to deal with this issue without introducing |
| 79 | * a huge performance overhead at an already costly feedback method. |
| 80 | * |
| 81 | * [1] 'https://llvm.org/svn/llvm-project/compiler-rt/branches/release_38/lib/sanitizer_common/sanitizer_coverage_libcdep.cc' |
| 82 | */ |
| 83 | #define kPcArrayMmapSize (64 * 1024) |
| 84 | |
| 85 | /* |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 86 | * bitmap implementation |
| 87 | */ |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 88 | static bitmap_t *sancov_newBitmap(uint32_t capacity) |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 89 | { |
Jagger | 679c205 | 2016-03-18 22:53:53 +0100 | [diff] [blame] | 90 | bitmap_t *pBM = util_Malloc(sizeof(bitmap_t)); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 91 | pBM->capacity = capacity; |
| 92 | pBM->nChunks = (capacity + 31) / 32; |
Jagger | 74d0d10 | 2016-03-18 22:55:59 +0100 | [diff] [blame] | 93 | pBM->pChunks = util_Calloc(pBM->nChunks * sizeof(uint32_t)); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 94 | return pBM; |
| 95 | } |
| 96 | |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 97 | static inline bool sancov_queryBitmap(bitmap_t * pBM, uint32_t index) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 98 | { |
Anestis Bechtsoudis | 58c45d2 | 2016-01-10 15:05:39 +0200 | [diff] [blame] | 99 | if (index > pBM->capacity) { |
| 100 | LOG_E("bitmap overflow (%u)", index); |
| 101 | return false; |
| 102 | } |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 103 | if (pBM->pChunks[index / 32] & (1 << (index % 32))) { |
| 104 | return true; |
| 105 | } |
| 106 | return false; |
| 107 | } |
| 108 | |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 109 | static inline void sancov_setBitmap(bitmap_t * pBM, uint32_t index) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 110 | { |
| 111 | /* This will be removed. So far checks only to verify accepted ranges. */ |
| 112 | if (index >= pBM->capacity) { |
| 113 | LOG_E("Out of range index (%u > %u)", index, pBM->capacity); |
| 114 | } |
| 115 | pBM->pChunks[index / 32] |= (1 << (index % 32)); |
| 116 | } |
| 117 | |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 118 | static inline void sancov_destroyBitmap(bitmap_t * pBM) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 119 | { |
| 120 | free(pBM->pChunks); |
| 121 | free(pBM); |
| 122 | } |
| 123 | |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 124 | /* |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 125 | * Trie implementation |
| 126 | */ |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 127 | static node_t *sancov_trieCreateNode(char key) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 128 | { |
Jagger | 679c205 | 2016-03-18 22:53:53 +0100 | [diff] [blame] | 129 | node_t *node = (node_t *) util_Malloc(sizeof(node_t)); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 130 | node->key = key; |
| 131 | node->next = NULL; |
| 132 | node->children = NULL; |
| 133 | node->parent = NULL; |
| 134 | node->prev = NULL; |
| 135 | |
| 136 | /* Zero init node's data struct */ |
| 137 | memset(&node->data, 0, sizeof(trieData_t)); |
| 138 | return node; |
| 139 | } |
| 140 | |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 141 | static node_t *sancov_trieSearch(node_t * root, const char *key) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 142 | { |
| 143 | node_t *pNodeLevel = root, *pNodePtr = NULL; |
| 144 | int nodeLevelId = 0; |
| 145 | while (1) { |
| 146 | node_t *pNodeFound = NULL, *pCurNode = NULL; |
| 147 | for (pCurNode = pNodeLevel; pCurNode != NULL; pCurNode = pCurNode->next) { |
| 148 | if (pCurNode->key == *key) { |
| 149 | pNodeFound = pCurNode; |
| 150 | nodeLevelId++; |
| 151 | break; |
| 152 | } |
| 153 | } |
| 154 | if (pNodeFound == NULL) { |
| 155 | return NULL; |
| 156 | } |
| 157 | if (*key == '\0') { |
| 158 | pNodePtr = pCurNode; |
| 159 | return pNodePtr; |
| 160 | } |
| 161 | pNodeLevel = pNodeFound->children; |
| 162 | key++; |
| 163 | } |
| 164 | } |
| 165 | |
Robert Swiecki | 40ef840 | 2016-03-10 15:14:13 +0100 | [diff] [blame] | 166 | static void sancov_trieAdd(node_t ** root, const char *key) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 167 | { |
| 168 | if (*root == NULL) { |
| 169 | LOG_E("Invalid Trie (NULL root node)"); |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 170 | return; |
| 171 | } |
| 172 | |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 173 | /* Traverse Trie */ |
| 174 | node_t *pTravNode = (*root)->children; |
| 175 | if (pTravNode == NULL) { |
| 176 | /* First node */ |
Anestis Bechtsoudis | 267f0d8 | 2016-01-08 16:02:50 +0200 | [diff] [blame] | 177 | for (pTravNode = *root; *key != '\0'; pTravNode = pTravNode->children) { |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 178 | pTravNode->children = sancov_trieCreateNode(*key); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 179 | pTravNode->children->parent = pTravNode; |
| 180 | key++; |
| 181 | } |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 182 | pTravNode->children = sancov_trieCreateNode('\0'); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 183 | pTravNode->children->parent = pTravNode; |
| 184 | return; |
| 185 | } |
| 186 | |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 187 | while (*key != '\0') { |
| 188 | if (*key == pTravNode->key) { |
| 189 | key++; |
| 190 | pTravNode = pTravNode->children; |
| 191 | } else { |
| 192 | break; |
| 193 | } |
| 194 | } |
| 195 | while (pTravNode->next) { |
| 196 | if (*key == pTravNode->next->key) { |
| 197 | key++; |
Robert Swiecki | 40ef840 | 2016-03-10 15:14:13 +0100 | [diff] [blame] | 198 | sancov_trieAdd(&(pTravNode->next), key); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 199 | return; |
| 200 | } |
| 201 | pTravNode = pTravNode->next; |
| 202 | } |
| 203 | if (*key) { |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 204 | pTravNode->next = sancov_trieCreateNode(*key); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 205 | } else { |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 206 | pTravNode->next = sancov_trieCreateNode(*key); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 207 | } |
| 208 | pTravNode->next->parent = pTravNode->parent; |
| 209 | pTravNode->next->prev = pTravNode; |
| 210 | if (!*key) { |
| 211 | return; |
| 212 | } |
| 213 | key++; |
| 214 | for (pTravNode = pTravNode->next; *key; pTravNode = pTravNode->children) { |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 215 | pTravNode->children = sancov_trieCreateNode(*key); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 216 | pTravNode->children->parent = pTravNode; |
| 217 | key++; |
| 218 | } |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 219 | pTravNode->children = sancov_trieCreateNode('\0'); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 220 | pTravNode->children->parent = pTravNode; |
| 221 | |
| 222 | return; |
| 223 | } |
| 224 | |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 225 | static inline void sancov_trieFreeNode(node_t * node) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 226 | { |
| 227 | /* First destroy bitmap heap buffers allocated for instrumented maps */ |
| 228 | if (node->data.pBM) { |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 229 | sancov_destroyBitmap(node->data.pBM); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 230 | } |
| 231 | free(node); |
| 232 | } |
| 233 | |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 234 | static inline void sancov_trieCreate(node_t ** root) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 235 | { |
| 236 | /* Create root node if new Trie */ |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 237 | *root = sancov_trieCreateNode('\0'); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 238 | } |
| 239 | |
| 240 | /* Destroy Trie - iterate nodes and free memory */ |
Robert Swiecki | 3bfc33c | 2016-03-14 18:12:41 +0100 | [diff] [blame] | 241 | UNUSED static void sancov_trieDestroy(node_t * root) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 242 | { |
| 243 | node_t *pNode = root; |
| 244 | node_t *pNodeTmp = root; |
| 245 | while (pNode) { |
| 246 | while (pNode->children) { |
| 247 | pNode = pNode->children; |
| 248 | } |
| 249 | |
| 250 | if (pNode->prev && pNode->next) { |
| 251 | pNodeTmp = pNode; |
| 252 | pNode->next->prev = pNode->prev; |
| 253 | pNode->prev->next = pNode->next; |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 254 | sancov_trieFreeNode(pNodeTmp); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 255 | } else if (pNode->prev && !pNode->next) { |
| 256 | pNodeTmp = pNode; |
| 257 | pNode->prev->next = NULL; |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 258 | sancov_trieFreeNode(pNodeTmp); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 259 | } else if (!pNode->prev && pNode->next) { |
| 260 | pNodeTmp = pNode; |
| 261 | pNode->parent->children = pNode->next; |
| 262 | pNode->next->prev = NULL; |
| 263 | pNode = pNode->next; |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 264 | sancov_trieFreeNode(pNodeTmp); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 265 | } else { |
| 266 | pNodeTmp = pNode; |
| 267 | if (pNode->parent == NULL) { |
| 268 | /* Root */ |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 269 | sancov_trieFreeNode(pNodeTmp); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 270 | return; |
| 271 | } |
| 272 | pNode = pNode->parent; |
| 273 | pNode->children = NULL; |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 274 | sancov_trieFreeNode(pNodeTmp); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 275 | } |
| 276 | } |
| 277 | } |
| 278 | |
| 279 | /* Modified interpolation search algorithm to search for nearest address fit */ |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 280 | static inline uint64_t sancov_interpSearch(uint64_t * buf, uint64_t size, uint64_t key) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 281 | { |
| 282 | /* Avoid extra checks assuming caller always provides non-zero array size */ |
| 283 | uint64_t low = 0; |
| 284 | uint64_t high = size - 1; |
| 285 | uint64_t mid = high; |
| 286 | |
| 287 | while (buf[high] != buf[low] && key >= buf[low] && key <= buf[high]) { |
| 288 | mid = low + (key - buf[low]) * ((high - low) / (buf[high] - buf[low])); |
| 289 | if (buf[mid] < key) { |
| 290 | low = mid + 1; |
| 291 | } else if (key < buf[mid]) { |
| 292 | high = mid - 1; |
| 293 | } else { |
| 294 | return mid; |
| 295 | } |
| 296 | } |
| 297 | return mid; |
| 298 | } |
| 299 | |
| 300 | /* qsort struct comparison function (memMap_t struct start addr field) */ |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 301 | static int sancov_qsortCmp(const void *a, const void *b) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 302 | { |
| 303 | memMap_t *pA = (memMap_t *) a; |
| 304 | memMap_t *pB = (memMap_t *) b; |
| 305 | if (pA->start < pB->start) { |
| 306 | return -1; |
| 307 | } else if (pA->start > pB->start) { |
| 308 | return 1; |
| 309 | } else { |
| 310 | /* Normally we should never hit that case */ |
| 311 | LOG_W("Duplicate map start addr detected"); |
| 312 | return 0; |
| 313 | } |
| 314 | |
| 315 | } |
| 316 | |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 317 | static bool sancov_sanCovParseRaw(honggfuzz_t * hfuzz, fuzzer_t * fuzzer) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 318 | { |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 319 | int dataFd = -1; |
| 320 | uint8_t *dataBuf = NULL; |
| 321 | off_t dataFileSz = 0, pos = 0; |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 322 | bool is32bit = true; |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 323 | char covFile[PATH_MAX] = { 0 }; |
Jagger | 247c3b4 | 2016-03-21 23:24:05 +0100 | [diff] [blame] | 324 | pid_t targetPid = (hfuzz->linux.pid > 0) ? hfuzz->linux.pid : fuzzer->pid; |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 325 | |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 326 | /* Fuzzer local runtime data structs - need free() before exit */ |
| 327 | uint64_t *startMapsIndex = NULL; |
| 328 | memMap_t *mapsBuf = NULL; |
| 329 | |
| 330 | /* Local counters */ |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 331 | uint64_t nBBs = 0; /* Total BB hits found in raw file */ |
| 332 | uint64_t nZeroBBs = 0; /* Number of non-hit instrumented BBs */ |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 333 | uint64_t mapsNum = 0; /* Total number of entries in map file */ |
| 334 | uint64_t noCovMapsNum = 0; /* Loaded DSOs not compiled with coverage */ |
| 335 | |
Anestis Bechtsoudis | 267f0d8 | 2016-01-08 16:02:50 +0200 | [diff] [blame] | 336 | /* File line-by-line read help buffers */ |
Jagger | d6f74bb | 2016-03-19 02:51:18 +0100 | [diff] [blame] | 337 | __block char *pLine = NULL; |
Anestis Bechtsoudis | 267f0d8 | 2016-01-08 16:02:50 +0200 | [diff] [blame] | 338 | size_t lineSz = 0; |
| 339 | |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 340 | /* Coverage data analysis starts by parsing map file listing */ |
| 341 | snprintf(covFile, sizeof(covFile), "%s/%s/%d.sancov.map", hfuzz->workDir, _HF_SANCOV_DIR, |
Anestis Bechtsoudis | a7c56ce | 2016-02-07 12:53:20 +0200 | [diff] [blame] | 342 | targetPid); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 343 | if (!files_exists(covFile)) { |
| 344 | LOG_D("sancov map file not found"); |
| 345 | return false; |
| 346 | } |
| 347 | FILE *fCovMap = fopen(covFile, "rb"); |
| 348 | if (fCovMap == NULL) { |
| 349 | PLOG_E("Couldn't open '%s' - R/O mode", covFile); |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 350 | return false; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 351 | } |
Jagger | 4fe1869 | 2016-04-22 23:15:07 +0200 | [diff] [blame] | 352 | defer { |
| 353 | fclose(fCovMap); |
| 354 | }; |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 355 | |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 356 | /* First line contains PC length (32/64-bit) */ |
Anestis Bechtsoudis | 267f0d8 | 2016-01-08 16:02:50 +0200 | [diff] [blame] | 357 | if (getline(&pLine, &lineSz, fCovMap) == -1) { |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 358 | LOG_E("Invalid map file '%s'", covFile); |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 359 | return false; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 360 | } |
Jagger | 4fe1869 | 2016-04-22 23:15:07 +0200 | [diff] [blame] | 361 | defer { |
| 362 | free(pLine); |
| 363 | pLine = NULL; |
| 364 | }; |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 365 | |
Anestis Bechtsoudis | 267f0d8 | 2016-01-08 16:02:50 +0200 | [diff] [blame] | 366 | int pcLen = atoi(pLine); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 367 | if (pcLen == 32) { |
| 368 | is32bit = true; |
| 369 | } else if (pcLen == 64) { |
| 370 | is32bit = false; |
| 371 | } else { |
| 372 | LOG_E("Invalid PC length (%d) in map file '%s'", pcLen, covFile); |
| 373 | } |
Anestis Bechtsoudis | 1fc7cd4 | 2015-12-26 17:54:15 +0200 | [diff] [blame] | 374 | |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 375 | /* See if #maps is available from previous run to avoid realloc inside loop */ |
Jagger | d34417d | 2016-03-16 01:26:54 +0100 | [diff] [blame] | 376 | uint64_t prevMapsNum = ATOMIC_GET(hfuzz->sanCovCnts.dsoCnt); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 377 | if (prevMapsNum > 0) { |
Jagger | 679c205 | 2016-03-18 22:53:53 +0100 | [diff] [blame] | 378 | mapsBuf = util_Malloc(prevMapsNum * sizeof(memMap_t)); |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 379 | } |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 380 | /* It's OK to free(NULL) */ |
Jagger | 4fe1869 | 2016-04-22 23:15:07 +0200 | [diff] [blame] | 381 | defer { |
| 382 | free(mapsBuf); |
| 383 | }; |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 384 | |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 385 | /* Iterate map entries */ |
| 386 | for (;;) { |
Anestis Bechtsoudis | 267f0d8 | 2016-01-08 16:02:50 +0200 | [diff] [blame] | 387 | if (getline(&pLine, &lineSz, fCovMap) == -1) { |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 388 | break; |
| 389 | } |
| 390 | |
| 391 | /* Trim trailing whitespaces, not sure if needed copied from upstream sancov.py */ |
Anestis Bechtsoudis | 267f0d8 | 2016-01-08 16:02:50 +0200 | [diff] [blame] | 392 | char *lineEnd = pLine + strlen(pLine) - 1; |
Jagger | 43c33e5 | 2016-03-11 22:16:26 +0100 | [diff] [blame] | 393 | while (lineEnd > pLine && isspace((int)*lineEnd)) { |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 394 | lineEnd--; |
| 395 | } |
| 396 | *(lineEnd + 1) = 0; |
| 397 | |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 398 | /* |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 399 | * Each line has following format: |
| 400 | * Start End Base bin/DSO name |
| 401 | * b5843000 b584e6ac b5843000 liblog.so |
| 402 | */ |
Jagger | 05c79c5 | 2016-01-31 18:00:51 +0100 | [diff] [blame] | 403 | memMap_t mapData = {.start = 0 }; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 404 | char *savePtr = NULL; |
Anestis Bechtsoudis | 267f0d8 | 2016-01-08 16:02:50 +0200 | [diff] [blame] | 405 | mapData.start = strtoull(strtok_r(pLine, " ", &savePtr), NULL, 16); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 406 | mapData.end = strtoull(strtok_r(NULL, " ", &savePtr), NULL, 16); |
| 407 | mapData.base = strtoull(strtok_r(NULL, " ", &savePtr), NULL, 16); |
| 408 | char *mapName = strtok_r(NULL, " ", &savePtr); |
| 409 | memcpy(mapData.mapName, mapName, strlen(mapName)); |
| 410 | |
| 411 | /* Interaction with global Trie should mutex wrap to avoid threads races */ |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 412 | { |
Robert Swiecki | 76ecd5e | 2016-03-16 14:57:03 +0100 | [diff] [blame] | 413 | MX_SCOPED_LOCK(&hfuzz->sanCov_mutex); |
Robert Swiecki | 5d6e734 | 2016-03-16 15:36:11 +0100 | [diff] [blame] | 414 | |
Anestis Bechtsoudis | 1fd10c7 | 2016-01-07 12:38:45 +0200 | [diff] [blame] | 415 | /* Add entry to Trie with zero data if not already */ |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 416 | if (!sancov_trieSearch(hfuzz->covMetadata->children, mapData.mapName)) { |
Robert Swiecki | 40ef840 | 2016-03-10 15:14:13 +0100 | [diff] [blame] | 417 | sancov_trieAdd(&hfuzz->covMetadata, mapData.mapName); |
Anestis Bechtsoudis | 1fd10c7 | 2016-01-07 12:38:45 +0200 | [diff] [blame] | 418 | } |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 419 | } |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 420 | |
Anestis Bechtsoudis | 0ddd078 | 2016-12-28 18:33:28 +0200 | [diff] [blame] | 421 | /* If no DSO number history (first run) or new DSO loaded, realloc local maps metadata buf */ |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 422 | if (prevMapsNum == 0 || prevMapsNum < mapsNum) { |
Jagger | f49962d | 2016-07-21 22:49:54 +0200 | [diff] [blame] | 423 | if ((mapsBuf = |
| 424 | util_Realloc(mapsBuf, (size_t) (mapsNum + 1) * sizeof(memMap_t))) == NULL) { |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 425 | PLOG_E("realloc failed (sz=%" PRIu64 ")", (mapsNum + 1) * sizeof(memMap_t)); |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 426 | return false; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 427 | } |
| 428 | } |
Anestis Bechtsoudis | 1fd10c7 | 2016-01-07 12:38:45 +0200 | [diff] [blame] | 429 | |
| 430 | /* Add entry to local maps metadata array */ |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 431 | memcpy(&mapsBuf[mapsNum], &mapData, sizeof(memMap_t)); |
| 432 | |
| 433 | /* Increase loaded maps counter (includes non-instrumented DSOs too) */ |
| 434 | mapsNum++; |
| 435 | } |
| 436 | |
| 437 | /* Delete .sancov.map file */ |
Robert Swiecki | 8656cbb | 2016-03-30 19:06:37 +0200 | [diff] [blame] | 438 | if (hfuzz->linux.pid == 0 && hfuzz->persistent == false) { |
Jagger | 1ebc6dc | 2016-03-12 01:39:09 +0100 | [diff] [blame] | 439 | unlink(covFile); |
| 440 | } |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 441 | |
| 442 | /* Create a quick index array with maps start addresses */ |
Jagger | 679c205 | 2016-03-18 22:53:53 +0100 | [diff] [blame] | 443 | startMapsIndex = util_Malloc(mapsNum * sizeof(uint64_t)); |
Jagger | 4fe1869 | 2016-04-22 23:15:07 +0200 | [diff] [blame] | 444 | defer { |
| 445 | free(startMapsIndex); |
| 446 | }; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 447 | |
| 448 | /* Sort quick maps index */ |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 449 | qsort(mapsBuf, mapsNum, sizeof(memMap_t), sancov_qsortCmp); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 450 | for (size_t i = 0; i < mapsNum; i++) { |
| 451 | startMapsIndex[i] = mapsBuf[i].start; |
| 452 | } |
| 453 | |
| 454 | /* mmap() .sancov.raw file */ |
| 455 | snprintf(covFile, sizeof(covFile), "%s/%s/%d.sancov.raw", hfuzz->workDir, _HF_SANCOV_DIR, |
Anestis Bechtsoudis | a7c56ce | 2016-02-07 12:53:20 +0200 | [diff] [blame] | 456 | targetPid); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 457 | dataBuf = files_mapFile(covFile, &dataFileSz, &dataFd, false); |
| 458 | if (dataBuf == NULL) { |
| 459 | LOG_E("Couldn't open and map '%s' in R/O mode", covFile); |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 460 | return false; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 461 | } |
Jagger | 4fe1869 | 2016-04-22 23:15:07 +0200 | [diff] [blame] | 462 | defer { |
| 463 | munmap(dataBuf, dataFileSz); |
| 464 | close(dataFd); |
| 465 | }; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 466 | |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 467 | /* |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 468 | * Avoid cost of size checks inside raw data read loop by defining the read function |
| 469 | * & pivot size based on PC length. |
| 470 | */ |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 471 | uint64_t(*pReadRawBBAddrFunc) (const uint8_t *) = NULL; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 472 | uint8_t pivot = 0; |
| 473 | if (is32bit) { |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 474 | pReadRawBBAddrFunc = &util_getUINT32; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 475 | pivot = 4; |
| 476 | } else { |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 477 | pReadRawBBAddrFunc = &util_getUINT64; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 478 | pivot = 8; |
| 479 | } |
| 480 | |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 481 | /* |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 482 | * Take advantage of data locality (next processed addr is very likely to belong |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 483 | * to same map) to avoid Trie node search for each read entry. |
| 484 | */ |
| 485 | node_t *curMap = NULL; |
| 486 | uint64_t prevIndex = 0; |
| 487 | |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 488 | /* Iterate over data buffer containing list of hit BB addresses */ |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 489 | while (pos < dataFileSz) { |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 490 | uint64_t bbAddr = pReadRawBBAddrFunc(dataBuf + pos); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 491 | pos += pivot; |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 492 | /* Don't bother for zero BB addr (inserted checks without hit) */ |
| 493 | if (bbAddr == 0x0) { |
| 494 | nZeroBBs++; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 495 | continue; |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 496 | } else { |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 497 | /* Find best hit based on start addr & verify range for errors */ |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 498 | uint64_t bestFit = sancov_interpSearch(startMapsIndex, mapsNum, bbAddr); |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 499 | if (bbAddr >= mapsBuf[bestFit].start && bbAddr < mapsBuf[bestFit].end) { |
| 500 | /* Increase exe/DSO total BB counter */ |
| 501 | mapsBuf[bestFit].bbCnt++; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 502 | |
| 503 | /* Update current Trie node if map changed */ |
| 504 | if (curMap == NULL || (prevIndex != bestFit)) { |
| 505 | prevIndex = bestFit; |
| 506 | |
| 507 | /* Interaction with global Trie should mutex wrap to avoid threads races */ |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 508 | { |
Robert Swiecki | 76ecd5e | 2016-03-16 14:57:03 +0100 | [diff] [blame] | 509 | MX_SCOPED_LOCK(&hfuzz->sanCov_mutex); |
Robert Swiecki | 5d6e734 | 2016-03-16 15:36:11 +0100 | [diff] [blame] | 510 | |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 511 | curMap = |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 512 | sancov_trieSearch(hfuzz->covMetadata->children, |
| 513 | mapsBuf[bestFit].mapName); |
Anestis Bechtsoudis | 1fd10c7 | 2016-01-07 12:38:45 +0200 | [diff] [blame] | 514 | if (curMap == NULL) { |
| 515 | LOG_E("Corrupted Trie - '%s' not found", mapsBuf[bestFit].mapName); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 516 | continue; |
| 517 | } |
| 518 | |
| 519 | /* Maintain bitmaps only for exec/DSOs with coverage enabled - allocate on first use */ |
| 520 | if (curMap->data.pBM == NULL) { |
Anestis Bechtsoudis | 1fd10c7 | 2016-01-07 12:38:45 +0200 | [diff] [blame] | 521 | LOG_D("Allocating bitmap for map '%s'", mapsBuf[bestFit].mapName); |
Jagger | 3d97752 | 2016-08-21 19:15:59 +0200 | [diff] [blame] | 522 | curMap->data.pBM = sancov_newBitmap(_HF_SANCOV_BITMAP_SIZE); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 523 | |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 524 | /* |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 525 | * If bitmap allocation failed, unset cached Trie node ptr |
| 526 | * to execute this selection branch again. |
| 527 | */ |
| 528 | if (curMap->data.pBM == NULL) { |
| 529 | curMap = NULL; |
Anestis Bechtsoudis | 1fd10c7 | 2016-01-07 12:38:45 +0200 | [diff] [blame] | 530 | continue; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 531 | } |
| 532 | } |
| 533 | } |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 534 | } |
| 535 | |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 536 | /* If new relative BB addr update DSO's bitmap */ |
| 537 | uint32_t relAddr = (uint32_t) (bbAddr - mapsBuf[bestFit].base); |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 538 | if (!sancov_queryBitmap(curMap->data.pBM, relAddr)) { |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 539 | |
| 540 | /* Interaction with global Trie should mutex wrap to avoid threads races */ |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 541 | { |
Robert Swiecki | 76ecd5e | 2016-03-16 14:57:03 +0100 | [diff] [blame] | 542 | MX_SCOPED_LOCK(&hfuzz->sanCov_mutex); |
Robert Swiecki | 5d6e734 | 2016-03-16 15:36:11 +0100 | [diff] [blame] | 543 | |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 544 | sancov_setBitmap(curMap->data.pBM, relAddr); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 545 | } |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 546 | |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 547 | /* Also increase new BBs counter at worker's thread runtime data */ |
| 548 | mapsBuf[bestFit].newBBCnt++; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 549 | } |
| 550 | } else { |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 551 | /* |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 552 | * Normally this should never get executed. If hit, sanitizer |
| 553 | * coverage data collection come across some kind of bug. |
| 554 | */ |
Robert Swiecki | 37778e0 | 2016-03-15 15:45:28 +0100 | [diff] [blame] | 555 | LOG_E("Invalid BB addr (%#" PRIx64 ") at offset %" PRId64, bbAddr, (uint64_t) pos); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 556 | } |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 557 | } |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 558 | nBBs++; |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 559 | } |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 560 | |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 561 | /* Finally iterate over all instrumented maps to sum-up the number of newly met BB addresses */ |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 562 | for (uint64_t i = 0; i < mapsNum; i++) { |
Robert Swiecki | 142f941 | 2016-03-14 19:22:01 +0100 | [diff] [blame] | 563 | if (mapsBuf[i].bbCnt > 0) { |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 564 | fuzzer->sanCovCnts.newBBCnt += mapsBuf[i].newBBCnt; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 565 | } else { |
| 566 | noCovMapsNum++; |
| 567 | } |
| 568 | } |
| 569 | |
| 570 | /* Successful parsing - update fuzzer worker's counters */ |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 571 | fuzzer->sanCovCnts.hitBBCnt = nBBs; |
| 572 | fuzzer->sanCovCnts.totalBBCnt = nBBs + nZeroBBs; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 573 | fuzzer->sanCovCnts.dsoCnt = mapsNum; |
| 574 | fuzzer->sanCovCnts.iDsoCnt = mapsNum - noCovMapsNum; /* Instrumented DSOs */ |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 575 | |
Robert Swiecki | 8656cbb | 2016-03-30 19:06:37 +0200 | [diff] [blame] | 576 | if (hfuzz->linux.pid == 0 && hfuzz->persistent == false) { |
Jagger | 1ebc6dc | 2016-03-12 01:39:09 +0100 | [diff] [blame] | 577 | unlink(covFile); |
| 578 | } |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 579 | return true; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 580 | } |
| 581 | |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 582 | static bool sancov_sanCovParse(honggfuzz_t * hfuzz, fuzzer_t * fuzzer) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 583 | { |
| 584 | int dataFd = -1; |
| 585 | uint8_t *dataBuf = NULL; |
| 586 | off_t dataFileSz = 0, pos = 0; |
| 587 | bool is32bit = true; |
| 588 | char covFile[PATH_MAX] = { 0 }; |
| 589 | DIR *pSanCovDir = NULL; |
Jagger | 247c3b4 | 2016-03-21 23:24:05 +0100 | [diff] [blame] | 590 | pid_t targetPid = (hfuzz->linux.pid > 0) ? hfuzz->linux.pid : fuzzer->pid; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 591 | |
| 592 | snprintf(covFile, sizeof(covFile), "%s/%s/%s.%d.sancov", hfuzz->workDir, _HF_SANCOV_DIR, |
Anestis Bechtsoudis | a7c56ce | 2016-02-07 12:53:20 +0200 | [diff] [blame] | 593 | files_basename(hfuzz->cmdline[0]), targetPid); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 594 | if (!files_exists(covFile)) { |
| 595 | LOG_D("Target sancov file not found"); |
| 596 | return false; |
| 597 | } |
| 598 | |
Anestis Bechtsoudis | a7c56ce | 2016-02-07 12:53:20 +0200 | [diff] [blame] | 599 | /* Local cache file suffix to use for file search of target pid data */ |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 600 | char pidFSuffix[13] = { 0 }; |
Anestis Bechtsoudis | a7c56ce | 2016-02-07 12:53:20 +0200 | [diff] [blame] | 601 | snprintf(pidFSuffix, sizeof(pidFSuffix), "%d.sancov", targetPid); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 602 | |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 603 | /* Total BBs counter summarizes all DSOs */ |
| 604 | uint64_t nBBs = 0; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 605 | |
Anestis Bechtsoudis | a7c56ce | 2016-02-07 12:53:20 +0200 | [diff] [blame] | 606 | /* Iterate sancov dir for files generated against target pid */ |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 607 | snprintf(covFile, sizeof(covFile), "%s/%s", hfuzz->workDir, _HF_SANCOV_DIR); |
| 608 | pSanCovDir = opendir(covFile); |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 609 | if (pSanCovDir == NULL) { |
| 610 | PLOG_E("opendir('%s')", covFile); |
| 611 | return false; |
| 612 | } |
Jagger | 4fe1869 | 2016-04-22 23:15:07 +0200 | [diff] [blame] | 613 | defer { |
| 614 | closedir(pSanCovDir); |
| 615 | }; |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 616 | |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 617 | struct dirent *pDir = NULL; |
| 618 | while ((pDir = readdir(pSanCovDir)) != NULL) { |
Anestis Bechtsoudis | a7c56ce | 2016-02-07 12:53:20 +0200 | [diff] [blame] | 619 | /* Parse files with target's pid */ |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 620 | if (strstr(pDir->d_name, pidFSuffix)) { |
| 621 | snprintf(covFile, sizeof(covFile), "%s/%s/%s", hfuzz->workDir, _HF_SANCOV_DIR, |
| 622 | pDir->d_name); |
| 623 | dataBuf = files_mapFile(covFile, &dataFileSz, &dataFd, false); |
| 624 | if (dataBuf == NULL) { |
| 625 | LOG_E("Couldn't open and map '%s' in R/O mode", covFile); |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 626 | return false; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 627 | } |
Jagger | 4fe1869 | 2016-04-22 23:15:07 +0200 | [diff] [blame] | 628 | defer { |
| 629 | munmap(dataBuf, dataFileSz); |
| 630 | close(dataFd); |
| 631 | }; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 632 | |
| 633 | if (dataFileSz < 8) { |
| 634 | LOG_E("Coverage data file too short"); |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 635 | return false; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 636 | } |
| 637 | |
| 638 | /* Check magic values & derive PC length */ |
| 639 | uint64_t magic = util_getUINT64(dataBuf); |
| 640 | if (magic == kMagic32) { |
| 641 | is32bit = true; |
| 642 | } else if (magic == kMagic64) { |
| 643 | is32bit = false; |
| 644 | } else { |
| 645 | LOG_E("Invalid coverage data file"); |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 646 | return false; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 647 | } |
| 648 | pos += 8; |
| 649 | |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 650 | /* |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 651 | * Avoid cost of size checks inside raw data read loop by defining the read function |
| 652 | * & pivot size based on PC length. |
| 653 | */ |
| 654 | uint64_t(*pReadRawBBAddrFunc) (const uint8_t *) = NULL; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 655 | uint8_t pivot = 0; |
| 656 | if (is32bit) { |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 657 | pReadRawBBAddrFunc = &util_getUINT32; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 658 | pivot = 4; |
| 659 | } else { |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 660 | pReadRawBBAddrFunc = &util_getUINT64; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 661 | pivot = 8; |
| 662 | } |
| 663 | |
| 664 | while (pos < dataFileSz) { |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 665 | uint32_t bbAddr = pReadRawBBAddrFunc(dataBuf + pos); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 666 | pos += pivot; |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 667 | if (bbAddr == 0x0) { |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 668 | continue; |
| 669 | } |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 670 | nBBs++; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 671 | } |
| 672 | } |
| 673 | } |
| 674 | |
| 675 | /* Successful parsing - update fuzzer worker counters */ |
Anestis Bechtsoudis | 56e360f | 2016-01-11 14:29:17 +0200 | [diff] [blame] | 676 | fuzzer->sanCovCnts.hitBBCnt = nBBs; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 677 | |
Robert Swiecki | 8656cbb | 2016-03-30 19:06:37 +0200 | [diff] [blame] | 678 | if (hfuzz->linux.pid == 0 && hfuzz->persistent == false) { |
Jagger | 1ebc6dc | 2016-03-12 01:39:09 +0100 | [diff] [blame] | 679 | unlink(covFile); |
| 680 | } |
Jagger | f26b1b6 | 2016-03-19 01:59:30 +0100 | [diff] [blame] | 681 | return true; |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 682 | } |
| 683 | |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 684 | /* |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 685 | * Sanitizer coverage data are stored in FS can be parsed via two methods: |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 686 | * raw unpack & separate bin/DSO sancov file. Separate bin/DSO sancov file |
| 687 | * method is usually avoided since coverage data are lost if sanitizer unhandled |
| 688 | * signal. Additionally, the FS I/O overhead is bigger compared to raw unpack |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 689 | * method which uses runtime data structures. |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 690 | * |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 691 | * Enabled methods are controlled from sanitizer flags in arch.c |
| 692 | */ |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 693 | void sancov_Analyze(honggfuzz_t * hfuzz, fuzzer_t * fuzzer) |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 694 | { |
| 695 | if (!hfuzz->useSanCov) { |
| 696 | return; |
| 697 | } |
Robert Swiecki | 72d2bef | 2016-01-19 14:39:26 +0100 | [diff] [blame] | 698 | /* |
Anestis Bechtsoudis | 97633cc | 2016-01-13 16:25:57 +0200 | [diff] [blame] | 699 | * For now supported methods are implemented in fail-over nature. This will |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 700 | * change in the future when best method is concluded. |
| 701 | */ |
Jagger | 3db1d95 | 2016-03-10 02:02:46 +0100 | [diff] [blame] | 702 | if (sancov_sanCovParseRaw(hfuzz, fuzzer) == false) { |
| 703 | sancov_sanCovParse(hfuzz, fuzzer); |
Anestis Bechtsoudis | a16f70f | 2016-01-03 13:03:21 +0200 | [diff] [blame] | 704 | } |
Anestis Bechtsoudis | d76c3b8 | 2015-12-26 17:35:25 +0200 | [diff] [blame] | 705 | } |
Jagger | 0026560 | 2016-03-10 02:36:27 +0100 | [diff] [blame] | 706 | |
| 707 | bool sancov_Init(honggfuzz_t * hfuzz) |
| 708 | { |
Jagger | 9e7ccc1 | 2016-09-26 00:47:52 +0200 | [diff] [blame] | 709 | if (hfuzz->useSanCov == false) { |
| 710 | return true; |
| 711 | } |
| 712 | sancov_trieCreate(&hfuzz->covMetadata); |
| 713 | |
Jagger | 99626d3 | 2016-09-26 00:50:14 +0200 | [diff] [blame] | 714 | char sanCovOutDir[PATH_MAX] = { 0 }; |
| 715 | snprintf(sanCovOutDir, sizeof(sanCovOutDir), "%s/%s", hfuzz->workDir, _HF_SANCOV_DIR); |
| 716 | if (!files_exists(sanCovOutDir)) { |
| 717 | if (mkdir(sanCovOutDir, S_IRWXU | S_IXGRP | S_IXOTH) != 0) { |
| 718 | PLOG_E("mkdir() '%s' failed", sanCovOutDir); |
| 719 | } |
| 720 | } |
| 721 | |
Jagger | 0026560 | 2016-03-10 02:36:27 +0100 | [diff] [blame] | 722 | return true; |
| 723 | } |