Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2018 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #include <stddef.h> |
| 18 | #include <stdint.h> |
| 19 | #include <unistd.h> |
| 20 | |
| 21 | #include "perfetto/base/logging.h" |
| 22 | #include "perfetto/base/task_runner.h" |
Primiano Tucci | 2c5488f | 2019-06-01 03:27:28 +0100 | [diff] [blame^] | 23 | #include "perfetto/ext/base/utils.h" |
| 24 | #include "perfetto/ext/tracing/core/data_source_config.h" |
| 25 | #include "perfetto/ext/tracing/core/data_source_descriptor.h" |
| 26 | #include "perfetto/ext/tracing/core/producer.h" |
| 27 | #include "perfetto/ext/tracing/core/trace_writer.h" |
| 28 | #include "perfetto/ext/tracing/ipc/producer_ipc_client.h" |
| 29 | #include "perfetto/ext/tracing/ipc/service_ipc_host.h" |
Hector Dearman | faa22f8 | 2018-02-14 12:02:51 +0000 | [diff] [blame] | 30 | #include "perfetto/trace/test_event.pbzero.h" |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 31 | #include "src/base/test/test_task_runner.h" |
Florian Mayer | c29e0d3 | 2018-04-04 15:55:46 +0100 | [diff] [blame] | 32 | #include "src/tracing/ipc/default_socket.h" |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 33 | #include "test/task_runner_thread.h" |
Lalit Maganti | bfc3d3e | 2018-03-22 20:28:38 +0000 | [diff] [blame] | 34 | #include "test/task_runner_thread_delegates.h" |
Lalit Maganti | c4c3ceb | 2018-03-29 20:38:13 +0100 | [diff] [blame] | 35 | #include "test/test_helper.h" |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 36 | |
Primiano Tucci | 07e104d | 2018-04-03 20:45:35 +0200 | [diff] [blame] | 37 | #include "perfetto/trace/trace_packet.pbzero.h" |
| 38 | |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 39 | namespace perfetto { |
| 40 | namespace shm_fuzz { |
| 41 | |
Lalit Maganti | c4c3ceb | 2018-03-29 20:38:13 +0100 | [diff] [blame] | 42 | // If we're building on Android and starting the daemons ourselves, |
| 43 | // create the sockets in a world-writable location. |
| 44 | #if PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID) && \ |
| 45 | PERFETTO_BUILDFLAG(PERFETTO_START_DAEMONS) |
| 46 | #define TEST_PRODUCER_SOCK_NAME "/data/local/tmp/traced_producer" |
| 47 | #else |
Florian Mayer | c29e0d3 | 2018-04-04 15:55:46 +0100 | [diff] [blame] | 48 | #define TEST_PRODUCER_SOCK_NAME ::perfetto::GetProducerSocket() |
Lalit Maganti | c4c3ceb | 2018-03-29 20:38:13 +0100 | [diff] [blame] | 49 | #endif |
Florian Mayer | 43374ba | 2018-02-16 13:35:16 +0000 | [diff] [blame] | 50 | |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 51 | // Fake producer writing a protozero message of data into shared memory |
| 52 | // buffer, followed by a sentinel message to signal completion to the |
| 53 | // consumer. |
| 54 | class FakeProducer : public Producer { |
| 55 | public: |
Florian Mayer | 20c2c72 | 2018-02-15 14:10:16 +0000 | [diff] [blame] | 56 | FakeProducer(std::string name, |
| 57 | const uint8_t* data, |
| 58 | size_t size, |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 59 | std::function<void()> on_produced_and_committed) |
| 60 | : name_(std::move(name)), |
| 61 | data_(data), |
| 62 | size_(size), |
| 63 | on_produced_and_committed_(on_produced_and_committed) {} |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 64 | |
| 65 | void Connect(const char* socket_name, base::TaskRunner* task_runner) { |
Lalit Maganti | 8f47a5b | 2018-03-28 20:50:28 +0100 | [diff] [blame] | 66 | endpoint_ = ProducerIPCClient::Connect( |
| 67 | socket_name, this, "android.perfetto.FakeProducer", task_runner); |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 68 | } |
| 69 | |
| 70 | void OnConnect() override { |
| 71 | DataSourceDescriptor descriptor; |
| 72 | descriptor.set_name(name_); |
Lalit Maganti | 79a6991 | 2018-03-29 17:32:29 +0100 | [diff] [blame] | 73 | endpoint_->RegisterDataSource(descriptor); |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 74 | } |
| 75 | |
| 76 | void OnDisconnect() override {} |
| 77 | |
Florian Mayer | d0201d0 | 2018-10-02 15:14:36 +0100 | [diff] [blame] | 78 | void SetupDataSource(DataSourceInstanceID, const DataSourceConfig&) override { |
| 79 | } |
Primiano Tucci | 674076d | 2018-10-01 10:41:09 +0100 | [diff] [blame] | 80 | |
Primiano Tucci | afb72b5 | 2018-09-25 09:37:24 +0100 | [diff] [blame] | 81 | void StartDataSource(DataSourceInstanceID, |
| 82 | const DataSourceConfig& source_config) override { |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 83 | auto trace_writer = endpoint_->CreateTraceWriter( |
| 84 | static_cast<BufferID>(source_config.target_buffer())); |
Primiano Tucci | ecf9e4a | 2018-03-14 14:51:58 +0000 | [diff] [blame] | 85 | { |
Primiano Tucci | ecf9e4a | 2018-03-14 14:51:58 +0000 | [diff] [blame] | 86 | auto packet = trace_writer->NewTracePacket(); |
| 87 | packet->stream_writer_->WriteBytes(data_, size_); |
Primiano Tucci | ecf9e4a | 2018-03-14 14:51:58 +0000 | [diff] [blame] | 88 | } |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 89 | trace_writer->Flush(); |
| 90 | |
Primiano Tucci | ecf9e4a | 2018-03-14 14:51:58 +0000 | [diff] [blame] | 91 | { |
Primiano Tucci | ecf9e4a | 2018-03-14 14:51:58 +0000 | [diff] [blame] | 92 | auto end_packet = trace_writer->NewTracePacket(); |
| 93 | end_packet->set_for_testing()->set_str("end"); |
Primiano Tucci | ecf9e4a | 2018-03-14 14:51:58 +0000 | [diff] [blame] | 94 | } |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 95 | trace_writer->Flush(on_produced_and_committed_); |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 96 | } |
| 97 | |
Primiano Tucci | afb72b5 | 2018-09-25 09:37:24 +0100 | [diff] [blame] | 98 | void StopDataSource(DataSourceInstanceID) override {} |
Primiano Tucci | dca727d | 2018-04-04 11:31:55 +0200 | [diff] [blame] | 99 | void OnTracingSetup() override {} |
Primiano Tucci | d52e627 | 2018-04-06 19:06:53 +0200 | [diff] [blame] | 100 | void Flush(FlushRequestID, const DataSourceInstanceID*, size_t) override {} |
Ryan Savitski | ba8a5f5 | 2019-05-14 11:58:21 +0100 | [diff] [blame] | 101 | void ClearIncrementalState(const DataSourceInstanceID*, size_t) {} |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 102 | |
| 103 | private: |
| 104 | const std::string name_; |
| 105 | const uint8_t* data_; |
| 106 | const size_t size_; |
Florian Mayer | 6a1a4d5 | 2018-06-08 16:47:07 +0100 | [diff] [blame] | 107 | std::unique_ptr<TracingService::ProducerEndpoint> endpoint_; |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 108 | std::function<void()> on_produced_and_committed_; |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 109 | }; |
| 110 | |
| 111 | class FakeProducerDelegate : public ThreadDelegate { |
| 112 | public: |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 113 | FakeProducerDelegate(const uint8_t* data, |
| 114 | size_t size, |
| 115 | std::function<void()> on_produced_and_committed) |
| 116 | : data_(data), |
| 117 | size_(size), |
| 118 | on_produced_and_committed_(on_produced_and_committed) {} |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 119 | ~FakeProducerDelegate() override = default; |
| 120 | |
| 121 | void Initialize(base::TaskRunner* task_runner) override { |
Florian Mayer | 20c2c72 | 2018-02-15 14:10:16 +0000 | [diff] [blame] | 122 | producer_.reset(new FakeProducer("android.perfetto.FakeProducer", data_, |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 123 | size_, on_produced_and_committed_)); |
Lalit Maganti | c4c3ceb | 2018-03-29 20:38:13 +0100 | [diff] [blame] | 124 | producer_->Connect(TEST_PRODUCER_SOCK_NAME, task_runner); |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 125 | } |
| 126 | |
| 127 | private: |
| 128 | std::unique_ptr<FakeProducer> producer_; |
| 129 | const uint8_t* data_; |
| 130 | const size_t size_; |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 131 | std::function<void()> on_produced_and_committed_; |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 132 | }; |
| 133 | |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 134 | int FuzzSharedMemory(const uint8_t* data, size_t size); |
| 135 | |
| 136 | int FuzzSharedMemory(const uint8_t* data, size_t size) { |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 137 | base::TestTaskRunner task_runner; |
| 138 | |
Lalit Maganti | c4c3ceb | 2018-03-29 20:38:13 +0100 | [diff] [blame] | 139 | TestHelper helper(&task_runner); |
| 140 | helper.StartServiceIfRequired(); |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 141 | |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 142 | TaskRunnerThread producer_thread("perfetto.prd"); |
| 143 | producer_thread.Start(std::unique_ptr<FakeProducerDelegate>( |
Lalit Maganti | 36557d8 | 2018-04-11 14:36:17 +0100 | [diff] [blame] | 144 | new FakeProducerDelegate(data, size, |
| 145 | helper.WrapTask(task_runner.CreateCheckpoint( |
| 146 | "produced.and.committed"))))); |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 147 | |
Lalit Maganti | c4c3ceb | 2018-03-29 20:38:13 +0100 | [diff] [blame] | 148 | helper.ConnectConsumer(); |
Lalit Maganti | 36557d8 | 2018-04-11 14:36:17 +0100 | [diff] [blame] | 149 | helper.WaitForConsumerConnect(); |
Lalit Maganti | c4c3ceb | 2018-03-29 20:38:13 +0100 | [diff] [blame] | 150 | |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 151 | TraceConfig trace_config; |
Florian Mayer | 4c3580f | 2018-02-12 15:59:55 +0000 | [diff] [blame] | 152 | trace_config.add_buffers()->set_size_kb(8); |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 153 | |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 154 | auto* ds_config = trace_config.add_data_sources()->mutable_config(); |
| 155 | ds_config->set_name("android.perfetto.FakeProducer"); |
| 156 | ds_config->set_target_buffer(0); |
| 157 | |
Lalit Maganti | c4c3ceb | 2018-03-29 20:38:13 +0100 | [diff] [blame] | 158 | helper.StartTracing(trace_config); |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 159 | task_runner.RunUntilCheckpoint("produced.and.committed"); |
Lalit Maganti | bfc3d3e | 2018-03-22 20:28:38 +0000 | [diff] [blame] | 160 | |
Lalit Maganti | 36557d8 | 2018-04-11 14:36:17 +0100 | [diff] [blame] | 161 | helper.ReadData(); |
| 162 | helper.WaitForReadData(); |
Lalit Maganti | dd95ef9 | 2018-03-23 09:42:48 +0000 | [diff] [blame] | 163 | |
Florian Mayer | 60d1e13 | 2018-01-26 15:00:52 +0000 | [diff] [blame] | 164 | return 0; |
| 165 | } |
| 166 | |
| 167 | } // namespace shm_fuzz |
| 168 | } // namespace perfetto |
| 169 | |
| 170 | extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size); |
| 171 | |
| 172 | extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
| 173 | return perfetto::shm_fuzz::FuzzSharedMemory(data, size); |
| 174 | } |