1//===- FuzzerUtilFuchsia.cpp - Misc utils for Fuchsia. --------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// Misc utils implementation using Fuchsia/Zircon APIs. 10//===----------------------------------------------------------------------===// 11#include "FuzzerDefs.h" 12 13#if LIBFUZZER_FUCHSIA 14 15#include "FuzzerInternal.h" 16#include "FuzzerUtil.h" 17#include <cerrno> 18#include <cinttypes> 19#include <cstdint> 20#include <fcntl.h> 21#include <lib/fdio/spawn.h> 22#include <string> 23#include <sys/select.h> 24#include <thread> 25#include <unistd.h> 26#include <zircon/errors.h> 27#include <zircon/process.h> 28#include <zircon/sanitizer.h> 29#include <zircon/status.h> 30#include <zircon/syscalls.h> 31#include <zircon/syscalls/debug.h> 32#include <zircon/syscalls/exception.h> 33#include <zircon/syscalls/port.h> 34#include <zircon/types.h> 35 36namespace fuzzer { 37 38// Given that Fuchsia doesn't have the POSIX signals that libFuzzer was written 39// around, the general approach is to spin up dedicated threads to watch for 40// each requested condition (alarm, interrupt, crash). Of these, the crash 41// handler is the most involved, as it requires resuming the crashed thread in 42// order to invoke the sanitizers to get the needed state. 43 44// Forward declaration of assembly trampoline needed to resume crashed threads. 45// This appears to have external linkage to C++, which is why it's not in the 46// anonymous namespace. The assembly definition inside MakeTrampoline() 47// actually defines the symbol with internal linkage only. 48void CrashTrampolineAsm() __asm__("CrashTrampolineAsm"); 49 50namespace { 51 52// A magic value for the Zircon exception port, chosen to spell 'FUZZING' 53// when interpreted as a byte sequence on little-endian platforms. 54const uint64_t kFuzzingCrash = 0x474e495a5a5546; 55 56// Helper function to handle Zircon syscall failures. 57void ExitOnErr(zx_status_t Status, const char *Syscall) { 58 if (Status != ZX_OK) { 59 Printf("libFuzzer: %s failed: %s\n", Syscall, 60 _zx_status_get_string(Status)); 61 exit(1); 62 } 63} 64 65void AlarmHandler(int Seconds) { 66 while (true) { 67 SleepSeconds(Seconds); 68 Fuzzer::StaticAlarmCallback(); 69 } 70} 71 72void InterruptHandler() { 73 fd_set readfds; 74 // Ctrl-C sends ETX in Zircon. 75 do { 76 FD_ZERO(&readfds); 77 FD_SET(STDIN_FILENO, &readfds); 78 select(STDIN_FILENO + 1, &readfds, nullptr, nullptr, nullptr); 79 } while(!FD_ISSET(STDIN_FILENO, &readfds) || getchar() != 0x03); 80 Fuzzer::StaticInterruptCallback(); 81} 82 83// For the crash handler, we need to call Fuzzer::StaticCrashSignalCallback 84// without POSIX signal handlers. To achieve this, we use an assembly function 85// to add the necessary CFI unwinding information and a C function to bridge 86// from that back into C++. 87 88// FIXME: This works as a short-term solution, but this code really shouldn't be 89// architecture dependent. A better long term solution is to implement remote 90// unwinding and expose the necessary APIs through sanitizer_common and/or ASAN 91// to allow the exception handling thread to gather the crash state directly. 92// 93// Alternatively, Fuchsia may in future actually implement basic signal 94// handling for the machine trap signals. 95#if defined(__x86_64__) 96#define FOREACH_REGISTER(OP_REG, OP_NUM) \ 97 OP_REG(rax) \ 98 OP_REG(rbx) \ 99 OP_REG(rcx) \ 100 OP_REG(rdx) \ 101 OP_REG(rsi) \ 102 OP_REG(rdi) \ 103 OP_REG(rbp) \ 104 OP_REG(rsp) \ 105 OP_REG(r8) \ 106 OP_REG(r9) \ 107 OP_REG(r10) \ 108 OP_REG(r11) \ 109 OP_REG(r12) \ 110 OP_REG(r13) \ 111 OP_REG(r14) \ 112 OP_REG(r15) \ 113 OP_REG(rip) 114 115#elif defined(__aarch64__) 116#define FOREACH_REGISTER(OP_REG, OP_NUM) \ 117 OP_NUM(0) \ 118 OP_NUM(1) \ 119 OP_NUM(2) \ 120 OP_NUM(3) \ 121 OP_NUM(4) \ 122 OP_NUM(5) \ 123 OP_NUM(6) \ 124 OP_NUM(7) \ 125 OP_NUM(8) \ 126 OP_NUM(9) \ 127 OP_NUM(10) \ 128 OP_NUM(11) \ 129 OP_NUM(12) \ 130 OP_NUM(13) \ 131 OP_NUM(14) \ 132 OP_NUM(15) \ 133 OP_NUM(16) \ 134 OP_NUM(17) \ 135 OP_NUM(18) \ 136 OP_NUM(19) \ 137 OP_NUM(20) \ 138 OP_NUM(21) \ 139 OP_NUM(22) \ 140 OP_NUM(23) \ 141 OP_NUM(24) \ 142 OP_NUM(25) \ 143 OP_NUM(26) \ 144 OP_NUM(27) \ 145 OP_NUM(28) \ 146 OP_NUM(29) \ 147 OP_NUM(30) \ 148 OP_REG(sp) 149 150#else 151#error "Unsupported architecture for fuzzing on Fuchsia" 152#endif 153 154// Produces a CFI directive for the named or numbered register. 155#define CFI_OFFSET_REG(reg) ".cfi_offset " #reg ", %c[" #reg "]\n" 156#define CFI_OFFSET_NUM(num) CFI_OFFSET_REG(r##num) 157 158// Produces an assembler input operand for the named or numbered register. 159#define ASM_OPERAND_REG(reg) \ 160 [reg] "i"(offsetof(zx_thread_state_general_regs_t, reg)), 161#define ASM_OPERAND_NUM(num) \ 162 [r##num] "i"(offsetof(zx_thread_state_general_regs_t, r[num])), 163 164// Trampoline to bridge from the assembly below to the static C++ crash 165// callback. 166__attribute__((noreturn)) 167static void StaticCrashHandler() { 168 Fuzzer::StaticCrashSignalCallback(); 169 for (;;) { 170 _Exit(1); 171 } 172} 173 174// Creates the trampoline with the necessary CFI information to unwind through 175// to the crashing call stack. The attribute is necessary because the function 176// is never called; it's just a container around the assembly to allow it to 177// use operands for compile-time computed constants. 178__attribute__((used)) 179void MakeTrampoline() { 180 __asm__(".cfi_endproc\n" 181 ".pushsection .text.CrashTrampolineAsm\n" 182 ".type CrashTrampolineAsm,STT_FUNC\n" 183"CrashTrampolineAsm:\n" 184 ".cfi_startproc simple\n" 185 ".cfi_signal_frame\n" 186#if defined(__x86_64__) 187 ".cfi_return_column rip\n" 188 ".cfi_def_cfa rsp, 0\n" 189 FOREACH_REGISTER(CFI_OFFSET_REG, CFI_OFFSET_NUM) 190 "call %c[StaticCrashHandler]\n" 191 "ud2\n" 192#elif defined(__aarch64__) 193 ".cfi_return_column 33\n" 194 ".cfi_def_cfa sp, 0\n" 195 ".cfi_offset 33, %c[pc]\n" 196 FOREACH_REGISTER(CFI_OFFSET_REG, CFI_OFFSET_NUM) 197 "bl %[StaticCrashHandler]\n" 198#else 199#error "Unsupported architecture for fuzzing on Fuchsia" 200#endif 201 ".cfi_endproc\n" 202 ".size CrashTrampolineAsm, . - CrashTrampolineAsm\n" 203 ".popsection\n" 204 ".cfi_startproc\n" 205 : // No outputs 206 : FOREACH_REGISTER(ASM_OPERAND_REG, ASM_OPERAND_NUM) 207#if defined(__aarch64__) 208 ASM_OPERAND_REG(pc) 209#endif 210 [StaticCrashHandler] "i" (StaticCrashHandler)); 211} 212 213void CrashHandler(zx_handle_t *Event) { 214 // This structure is used to ensure we close handles to objects we create in 215 // this handler. 216 struct ScopedHandle { 217 ~ScopedHandle() { _zx_handle_close(Handle); } 218 zx_handle_t Handle = ZX_HANDLE_INVALID; 219 }; 220 221 // Create and bind the exception port. We need to claim to be a "debugger" so 222 // the kernel will allow us to modify and resume dying threads (see below). 223 // Once the port is set, we can signal the main thread to continue and wait 224 // for the exception to arrive. 225 ScopedHandle Port; 226 ExitOnErr(_zx_port_create(0, &Port.Handle), "_zx_port_create"); 227 zx_handle_t Self = _zx_process_self(); 228 229 ExitOnErr(_zx_task_bind_exception_port(Self, Port.Handle, kFuzzingCrash, 230 ZX_EXCEPTION_PORT_DEBUGGER), 231 "_zx_task_bind_exception_port"); 232 233 ExitOnErr(_zx_object_signal(*Event, 0, ZX_USER_SIGNAL_0), 234 "_zx_object_signal"); 235 236 zx_port_packet_t Packet; 237 ExitOnErr(_zx_port_wait(Port.Handle, ZX_TIME_INFINITE, &Packet), 238 "_zx_port_wait"); 239 240 // At this point, we want to get the state of the crashing thread, but 241 // libFuzzer and the sanitizers assume this will happen from that same thread 242 // via a POSIX signal handler. "Resurrecting" the thread in the middle of the 243 // appropriate callback is as simple as forcibly setting the instruction 244 // pointer/program counter, provided we NEVER EVER return from that function 245 // (since otherwise our stack will not be valid). 246 ScopedHandle Thread; 247 ExitOnErr(_zx_object_get_child(Self, Packet.exception.tid, 248 ZX_RIGHT_SAME_RIGHTS, &Thread.Handle), 249 "_zx_object_get_child"); 250 251 zx_thread_state_general_regs_t GeneralRegisters; 252 ExitOnErr(_zx_thread_read_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS, 253 &GeneralRegisters, sizeof(GeneralRegisters)), 254 "_zx_thread_read_state"); 255 256 // To unwind properly, we need to push the crashing thread's register state 257 // onto the stack and jump into a trampoline with CFI instructions on how 258 // to restore it. 259#if defined(__x86_64__) 260 uintptr_t StackPtr = 261 (GeneralRegisters.rsp - (128 + sizeof(GeneralRegisters))) & 262 -(uintptr_t)16; 263 __unsanitized_memcpy(reinterpret_cast<void *>(StackPtr), &GeneralRegisters, 264 sizeof(GeneralRegisters)); 265 GeneralRegisters.rsp = StackPtr; 266 GeneralRegisters.rip = reinterpret_cast<zx_vaddr_t>(CrashTrampolineAsm); 267 268#elif defined(__aarch64__) 269 uintptr_t StackPtr = 270 (GeneralRegisters.sp - sizeof(GeneralRegisters)) & -(uintptr_t)16; 271 __unsanitized_memcpy(reinterpret_cast<void *>(StackPtr), &GeneralRegisters, 272 sizeof(GeneralRegisters)); 273 GeneralRegisters.sp = StackPtr; 274 GeneralRegisters.pc = reinterpret_cast<zx_vaddr_t>(CrashTrampolineAsm); 275 276#else 277#error "Unsupported architecture for fuzzing on Fuchsia" 278#endif 279 280 // Now force the crashing thread's state. 281 ExitOnErr(_zx_thread_write_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS, 282 &GeneralRegisters, sizeof(GeneralRegisters)), 283 "_zx_thread_write_state"); 284 285 ExitOnErr(_zx_task_resume_from_exception(Thread.Handle, Port.Handle, 0), 286 "_zx_task_resume_from_exception"); 287} 288 289} // namespace 290 291// Platform specific functions. 292void SetSignalHandler(const FuzzingOptions &Options) { 293 // Set up alarm handler if needed. 294 if (Options.UnitTimeoutSec > 0) { 295 std::thread T(AlarmHandler, Options.UnitTimeoutSec / 2 + 1); 296 T.detach(); 297 } 298 299 // Set up interrupt handler if needed. 300 if (Options.HandleInt || Options.HandleTerm) { 301 std::thread T(InterruptHandler); 302 T.detach(); 303 } 304 305 // Early exit if no crash handler needed. 306 if (!Options.HandleSegv && !Options.HandleBus && !Options.HandleIll && 307 !Options.HandleFpe && !Options.HandleAbrt) 308 return; 309 310 // Set up the crash handler and wait until it is ready before proceeding. 311 zx_handle_t Event; 312 ExitOnErr(_zx_event_create(0, &Event), "_zx_event_create"); 313 314 std::thread T(CrashHandler, &Event); 315 zx_status_t Status = 316 _zx_object_wait_one(Event, ZX_USER_SIGNAL_0, ZX_TIME_INFINITE, nullptr); 317 _zx_handle_close(Event); 318 ExitOnErr(Status, "_zx_object_wait_one"); 319 320 T.detach(); 321} 322 323void SleepSeconds(int Seconds) { 324 _zx_nanosleep(_zx_deadline_after(ZX_SEC(Seconds))); 325} 326 327unsigned long GetPid() { 328 zx_status_t rc; 329 zx_info_handle_basic_t Info; 330 if ((rc = _zx_object_get_info(_zx_process_self(), ZX_INFO_HANDLE_BASIC, &Info, 331 sizeof(Info), NULL, NULL)) != ZX_OK) { 332 Printf("libFuzzer: unable to get info about self: %s\n", 333 _zx_status_get_string(rc)); 334 exit(1); 335 } 336 return Info.koid; 337} 338 339size_t GetPeakRSSMb() { 340 zx_status_t rc; 341 zx_info_task_stats_t Info; 342 if ((rc = _zx_object_get_info(_zx_process_self(), ZX_INFO_TASK_STATS, &Info, 343 sizeof(Info), NULL, NULL)) != ZX_OK) { 344 Printf("libFuzzer: unable to get info about self: %s\n", 345 _zx_status_get_string(rc)); 346 exit(1); 347 } 348 return (Info.mem_private_bytes + Info.mem_shared_bytes) >> 20; 349} 350 351template <typename Fn> 352class RunOnDestruction { 353 public: 354 explicit RunOnDestruction(Fn fn) : fn_(fn) {} 355 ~RunOnDestruction() { fn_(); } 356 357 private: 358 Fn fn_; 359}; 360 361template <typename Fn> 362RunOnDestruction<Fn> at_scope_exit(Fn fn) { 363 return RunOnDestruction<Fn>(fn); 364} 365 366int ExecuteCommand(const Command &Cmd) { 367 zx_status_t rc; 368 369 // Convert arguments to C array 370 auto Args = Cmd.getArguments(); 371 size_t Argc = Args.size(); 372 assert(Argc != 0); 373 std::unique_ptr<const char *[]> Argv(new const char *[Argc + 1]); 374 for (size_t i = 0; i < Argc; ++i) 375 Argv[i] = Args[i].c_str(); 376 Argv[Argc] = nullptr; 377 378 // Determine output. On Fuchsia, the fuzzer is typically run as a component 379 // that lacks a mutable working directory. Fortunately, when this is the case 380 // a mutable output directory must be specified using "-artifact_prefix=...", 381 // so write the log file(s) there. 382 int FdOut = STDOUT_FILENO; 383 if (Cmd.hasOutputFile()) { 384 std::string Path; 385 if (Cmd.hasFlag("artifact_prefix")) 386 Path = Cmd.getFlagValue("artifact_prefix") + "/" + Cmd.getOutputFile(); 387 else 388 Path = Cmd.getOutputFile(); 389 FdOut = open(Path.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0); 390 if (FdOut == -1) { 391 Printf("libFuzzer: failed to open %s: %s\n", Path.c_str(), 392 strerror(errno)); 393 return ZX_ERR_IO; 394 } 395 } 396 auto CloseFdOut = at_scope_exit([FdOut]() { 397 if (FdOut != STDOUT_FILENO) 398 close(FdOut); 399 }); 400 401 // Determine stderr 402 int FdErr = STDERR_FILENO; 403 if (Cmd.isOutAndErrCombined()) 404 FdErr = FdOut; 405 406 // Clone the file descriptors into the new process 407 fdio_spawn_action_t SpawnAction[] = { 408 { 409 .action = FDIO_SPAWN_ACTION_CLONE_FD, 410 .fd = 411 { 412 .local_fd = STDIN_FILENO, 413 .target_fd = STDIN_FILENO, 414 }, 415 }, 416 { 417 .action = FDIO_SPAWN_ACTION_CLONE_FD, 418 .fd = 419 { 420 .local_fd = FdOut, 421 .target_fd = STDOUT_FILENO, 422 }, 423 }, 424 { 425 .action = FDIO_SPAWN_ACTION_CLONE_FD, 426 .fd = 427 { 428 .local_fd = FdErr, 429 .target_fd = STDERR_FILENO, 430 }, 431 }, 432 }; 433 434 // Start the process. 435 char ErrorMsg[FDIO_SPAWN_ERR_MSG_MAX_LENGTH]; 436 zx_handle_t ProcessHandle = ZX_HANDLE_INVALID; 437 rc = fdio_spawn_etc( 438 ZX_HANDLE_INVALID, FDIO_SPAWN_CLONE_ALL & (~FDIO_SPAWN_CLONE_STDIO), 439 Argv[0], Argv.get(), nullptr, 3, SpawnAction, &ProcessHandle, ErrorMsg); 440 if (rc != ZX_OK) { 441 Printf("libFuzzer: failed to launch '%s': %s, %s\n", Argv[0], ErrorMsg, 442 _zx_status_get_string(rc)); 443 return rc; 444 } 445 auto CloseHandle = at_scope_exit([&]() { _zx_handle_close(ProcessHandle); }); 446 447 // Now join the process and return the exit status. 448 if ((rc = _zx_object_wait_one(ProcessHandle, ZX_PROCESS_TERMINATED, 449 ZX_TIME_INFINITE, nullptr)) != ZX_OK) { 450 Printf("libFuzzer: failed to join '%s': %s\n", Argv[0], 451 _zx_status_get_string(rc)); 452 return rc; 453 } 454 455 zx_info_process_t Info; 456 if ((rc = _zx_object_get_info(ProcessHandle, ZX_INFO_PROCESS, &Info, 457 sizeof(Info), nullptr, nullptr)) != ZX_OK) { 458 Printf("libFuzzer: unable to get return code from '%s': %s\n", Argv[0], 459 _zx_status_get_string(rc)); 460 return rc; 461 } 462 463 return Info.return_code; 464} 465 466const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt, 467 size_t PattLen) { 468 return memmem(Data, DataLen, Patt, PattLen); 469} 470 471} // namespace fuzzer 472 473#endif // LIBFUZZER_FUCHSIA 474