1//===- FuzzerUtilDarwin.cpp - Misc utils ----------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8// Misc utils for Darwin.
9//===----------------------------------------------------------------------===//
10#include "FuzzerDefs.h"
11#if LIBFUZZER_APPLE
12#include "FuzzerCommand.h"
13#include "FuzzerIO.h"
14#include <mutex>
15#include <signal.h>
16#include <spawn.h>
17#include <stdlib.h>
18#include <string.h>
19#include <sys/wait.h>
20#include <unistd.h>
21
22// There is no header for this on macOS so declare here
23extern "C" char **environ;
24
25namespace fuzzer {
26
27static std::mutex SignalMutex;
28// Global variables used to keep track of how signal handling should be
29// restored. They should **not** be accessed without holding `SignalMutex`.
30static int ActiveThreadCount = 0;
31static struct sigaction OldSigIntAction;
32static struct sigaction OldSigQuitAction;
33static sigset_t OldBlockedSignalsSet;
34
35// This is a reimplementation of Libc's `system()`. On Darwin the Libc
36// implementation contains a mutex which prevents it from being used
37// concurrently. This implementation **can** be used concurrently. It sets the
38// signal handlers when the first thread enters and restores them when the last
39// thread finishes execution of the function and ensures this is not racey by
40// using a mutex.
41int ExecuteCommand(const Command &Cmd) {
42  std::string CmdLine = Cmd.toString();
43  posix_spawnattr_t SpawnAttributes;
44  if (posix_spawnattr_init(&SpawnAttributes))
45    return -1;
46  // Block and ignore signals of the current process when the first thread
47  // enters.
48  {
49    std::lock_guard<std::mutex> Lock(SignalMutex);
50    if (ActiveThreadCount == 0) {
51      static struct sigaction IgnoreSignalAction;
52      sigset_t BlockedSignalsSet;
53      memset(&IgnoreSignalAction, 0, sizeof(IgnoreSignalAction));
54      IgnoreSignalAction.sa_handler = SIG_IGN;
55
56      if (sigaction(SIGINT, &IgnoreSignalAction, &OldSigIntAction) == -1) {
57        Printf("Failed to ignore SIGINT\n");
58        (void)posix_spawnattr_destroy(&SpawnAttributes);
59        return -1;
60      }
61      if (sigaction(SIGQUIT, &IgnoreSignalAction, &OldSigQuitAction) == -1) {
62        Printf("Failed to ignore SIGQUIT\n");
63        // Try our best to restore the signal handlers.
64        (void)sigaction(SIGINT, &OldSigIntAction, NULL);
65        (void)posix_spawnattr_destroy(&SpawnAttributes);
66        return -1;
67      }
68
69      (void)sigemptyset(&BlockedSignalsSet);
70      (void)sigaddset(&BlockedSignalsSet, SIGCHLD);
71      if (sigprocmask(SIG_BLOCK, &BlockedSignalsSet, &OldBlockedSignalsSet) ==
72          -1) {
73        Printf("Failed to block SIGCHLD\n");
74        // Try our best to restore the signal handlers.
75        (void)sigaction(SIGQUIT, &OldSigQuitAction, NULL);
76        (void)sigaction(SIGINT, &OldSigIntAction, NULL);
77        (void)posix_spawnattr_destroy(&SpawnAttributes);
78        return -1;
79      }
80    }
81    ++ActiveThreadCount;
82  }
83
84  // NOTE: Do not introduce any new `return` statements past this
85  // point. It is important that `ActiveThreadCount` always be decremented
86  // when leaving this function.
87
88  // Make sure the child process uses the default handlers for the
89  // following signals rather than inheriting what the parent has.
90  sigset_t DefaultSigSet;
91  (void)sigemptyset(&DefaultSigSet);
92  (void)sigaddset(&DefaultSigSet, SIGQUIT);
93  (void)sigaddset(&DefaultSigSet, SIGINT);
94  (void)posix_spawnattr_setsigdefault(&SpawnAttributes, &DefaultSigSet);
95  // Make sure the child process doesn't block SIGCHLD
96  (void)posix_spawnattr_setsigmask(&SpawnAttributes, &OldBlockedSignalsSet);
97  short SpawnFlags = POSIX_SPAWN_SETSIGDEF | POSIX_SPAWN_SETSIGMASK;
98  (void)posix_spawnattr_setflags(&SpawnAttributes, SpawnFlags);
99
100  pid_t Pid;
101  char **Environ = environ; // Read from global
102  const char *CommandCStr = CmdLine.c_str();
103  char *const Argv[] = {
104    strdup("sh"),
105    strdup("-c"),
106    strdup(CommandCStr),
107    NULL
108  };
109  int ErrorCode = 0, ProcessStatus = 0;
110  // FIXME: We probably shouldn't hardcode the shell path.
111  ErrorCode = posix_spawn(&Pid, "/bin/sh", NULL, &SpawnAttributes,
112                          Argv, Environ);
113  (void)posix_spawnattr_destroy(&SpawnAttributes);
114  if (!ErrorCode) {
115    pid_t SavedPid = Pid;
116    do {
117      // Repeat until call completes uninterrupted.
118      Pid = waitpid(SavedPid, &ProcessStatus, /*options=*/0);
119    } while (Pid == -1 && errno == EINTR);
120    if (Pid == -1) {
121      // Fail for some other reason.
122      ProcessStatus = -1;
123    }
124  } else if (ErrorCode == ENOMEM || ErrorCode == EAGAIN) {
125    // Fork failure.
126    ProcessStatus = -1;
127  } else {
128    // Shell execution failure.
129    ProcessStatus = W_EXITCODE(127, 0);
130  }
131  for (unsigned i = 0, n = sizeof(Argv) / sizeof(Argv[0]); i < n; ++i)
132    free(Argv[i]);
133
134  // Restore the signal handlers of the current process when the last thread
135  // using this function finishes.
136  {
137    std::lock_guard<std::mutex> Lock(SignalMutex);
138    --ActiveThreadCount;
139    if (ActiveThreadCount == 0) {
140      bool FailedRestore = false;
141      if (sigaction(SIGINT, &OldSigIntAction, NULL) == -1) {
142        Printf("Failed to restore SIGINT handling\n");
143        FailedRestore = true;
144      }
145      if (sigaction(SIGQUIT, &OldSigQuitAction, NULL) == -1) {
146        Printf("Failed to restore SIGQUIT handling\n");
147        FailedRestore = true;
148      }
149      if (sigprocmask(SIG_BLOCK, &OldBlockedSignalsSet, NULL) == -1) {
150        Printf("Failed to unblock SIGCHLD\n");
151        FailedRestore = true;
152      }
153      if (FailedRestore)
154        ProcessStatus = -1;
155    }
156  }
157  return ProcessStatus;
158}
159
160void DiscardOutput(int Fd) {
161  FILE* Temp = fopen("/dev/null", "w");
162  if (!Temp)
163    return;
164  dup2(fileno(Temp), Fd);
165  fclose(Temp);
166}
167
168} // namespace fuzzer
169
170#endif // LIBFUZZER_APPLE
171