1 /*
2 *
3 * honggfuzz - routines dealing with subprocesses
4 * -----------------------------------------
5 *
6 * Author: Robert Swiecki <swiecki@google.com>
7 * Felix Gröbert <groebert@google.com>
8 *
9 * Copyright 2010-2018 by Google Inc. All Rights Reserved.
10 *
11 * Licensed under the Apache License, Version 2.0 (the "License"); you may
12 * not use this file except in compliance with the License. You may obtain
13 * a copy of the License at
14 *
15 * http://www.apache.org/licenses/LICENSE-2.0
16 *
17 * Unless required by applicable law or agreed to in writing, software
18 * distributed under the License is distributed on an "AS IS" BASIS,
19 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
20 * implied. See the License for the specific language governing
21 * permissions and limitations under the License.
22 *
23 */
24
25 #include "subproc.h"
26
27 #include <errno.h>
28 #include <fcntl.h>
29 #include <inttypes.h>
30 #include <signal.h>
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <string.h>
34 #include <sys/resource.h>
35 #include <sys/socket.h>
36 #include <sys/time.h>
37 #include <sys/types.h>
38 #include <sys/wait.h>
39 #include <unistd.h>
40
41 #include "arch.h"
42 #include "fuzz.h"
43 #include "libhfcommon/common.h"
44 #include "libhfcommon/files.h"
45 #include "libhfcommon/log.h"
46 #include "libhfcommon/util.h"
47
48 extern char** environ;
49
subproc_StatusToStr(int status,char * str,size_t len)50 const char* subproc_StatusToStr(int status, char* str, size_t len) {
51 if (WIFEXITED(status)) {
52 snprintf(str, len, "EXITED, exit code: %d", WEXITSTATUS(status));
53 return str;
54 }
55
56 if (WIFSIGNALED(status)) {
57 snprintf(
58 str, len, "SIGNALED, signal: %d (%s)", WTERMSIG(status), strsignal(WTERMSIG(status)));
59 return str;
60 }
61 if (WIFCONTINUED(status)) {
62 snprintf(str, len, "CONTINUED");
63 return str;
64 }
65
66 if (!WIFSTOPPED(status)) {
67 snprintf(str, len, "UNKNOWN STATUS: %d", status);
68 return str;
69 }
70
71 /* Must be in a stopped state */
72 if (WSTOPSIG(status) == (SIGTRAP | 0x80)) {
73 snprintf(str, len, "STOPPED (linux syscall): %d (%s)", WSTOPSIG(status),
74 strsignal(WSTOPSIG(status)));
75 return str;
76 }
77 #if defined(PTRACE_EVENT_STOP)
78 #define __LINUX_WPTRACEEVENT(x) ((x & 0xff0000) >> 16)
79 if (WSTOPSIG(status) == SIGTRAP && __LINUX_WPTRACEEVENT(status) != 0) {
80 switch (__LINUX_WPTRACEEVENT(status)) {
81 case PTRACE_EVENT_FORK:
82 snprintf(str, len, "EVENT (Linux) - fork - with signal: %d (%s)", WSTOPSIG(status),
83 strsignal(WSTOPSIG(status)));
84 return str;
85 case PTRACE_EVENT_VFORK:
86 snprintf(str, len, "EVENT (Linux) - vfork - with signal: %d (%s)", WSTOPSIG(status),
87 strsignal(WSTOPSIG(status)));
88 return str;
89 case PTRACE_EVENT_CLONE:
90 snprintf(str, len, "EVENT (Linux) - clone - with signal: %d (%s)", WSTOPSIG(status),
91 strsignal(WSTOPSIG(status)));
92 return str;
93 case PTRACE_EVENT_EXEC:
94 snprintf(str, len, "EVENT (Linux) - exec - with signal: %d (%s)", WSTOPSIG(status),
95 strsignal(WSTOPSIG(status)));
96 return str;
97 case PTRACE_EVENT_VFORK_DONE:
98 snprintf(str, len, "EVENT (Linux) - vfork_done - with signal: %d (%s)",
99 WSTOPSIG(status), strsignal(WSTOPSIG(status)));
100 return str;
101 case PTRACE_EVENT_EXIT:
102 snprintf(str, len, "EVENT (Linux) - exit - with signal: %d (%s)", WSTOPSIG(status),
103 strsignal(WSTOPSIG(status)));
104 return str;
105 case PTRACE_EVENT_SECCOMP:
106 snprintf(str, len, "EVENT (Linux) - seccomp - with signal: %d (%s)",
107 WSTOPSIG(status), strsignal(WSTOPSIG(status)));
108 return str;
109 case PTRACE_EVENT_STOP:
110 snprintf(str, len, "EVENT (Linux) - stop - with signal: %d (%s)", WSTOPSIG(status),
111 strsignal(WSTOPSIG(status)));
112 return str;
113 default:
114 snprintf(str, len, "EVENT (Linux) UNKNOWN (%d): with signal: %d (%s)",
115 __LINUX_WPTRACEEVENT(status), WSTOPSIG(status), strsignal(WSTOPSIG(status)));
116 return str;
117 }
118 }
119 #endif /* defined(PTRACE_EVENT_STOP) */
120
121 snprintf(
122 str, len, "STOPPED with signal: %d (%s)", WSTOPSIG(status), strsignal(WSTOPSIG(status)));
123 return str;
124 }
125
subproc_persistentSendFileIndicator(run_t * run)126 static bool subproc_persistentSendFileIndicator(run_t* run) {
127 uint64_t len = (uint64_t)run->dynamicFileSz;
128 if (!files_sendToSocketNB(run->persistentSock, (uint8_t*)&len, sizeof(len))) {
129 PLOG_W("files_sendToSocketNB(len=%zu)", sizeof(len));
130 return false;
131 }
132 return true;
133 }
134
subproc_persistentGetReady(run_t * run)135 static bool subproc_persistentGetReady(run_t* run) {
136 uint8_t rcv;
137 if (recv(run->persistentSock, &rcv, sizeof(rcv), MSG_DONTWAIT) != sizeof(rcv)) {
138 return false;
139 }
140 if (rcv != HFReadyTag) {
141 LOG_E("Received invalid message from the persistent process: '%c' (0x%" PRIx8
142 ") , expected '%c' (0x%" PRIx8 ")",
143 rcv, rcv, HFReadyTag, HFReadyTag);
144 return false;
145 }
146 return true;
147 }
148
subproc_persistentModeStateMachine(run_t * run)149 bool subproc_persistentModeStateMachine(run_t* run) {
150 if (!run->global->exe.persistent) {
151 return false;
152 }
153
154 for (;;) {
155 switch (run->runState) {
156 case _HF_RS_WAITING_FOR_INITIAL_READY: {
157 if (!subproc_persistentGetReady(run)) {
158 return false;
159 }
160 run->runState = _HF_RS_SEND_DATA;
161 }; break;
162 case _HF_RS_SEND_DATA: {
163 if (!subproc_persistentSendFileIndicator(run)) {
164 LOG_E("Could not send the file size indicator to the persistent process. "
165 "Killing the process pid=%d",
166 (int)run->pid);
167 kill(run->pid, SIGKILL);
168 return false;
169 }
170 run->runState = _HF_RS_WAITING_FOR_READY;
171 }; break;
172 case _HF_RS_WAITING_FOR_READY: {
173 if (!subproc_persistentGetReady(run)) {
174 return false;
175 }
176 run->runState = _HF_RS_SEND_DATA;
177 /* The current persistent round is done */
178 return true;
179 }; break;
180 default: {
181 LOG_F("Unknown runState: %d", run->runState);
182 }; break;
183 }
184 }
185 }
186
subproc_PrepareExecv(run_t * run)187 static bool subproc_PrepareExecv(run_t* run) {
188 /*
189 * The address space limit. If big enough - roughly the size of RAM used
190 */
191 #ifdef RLIMIT_AS
192 if (run->global->exe.asLimit) {
193 const struct rlimit rl = {
194 .rlim_cur = run->global->exe.asLimit * 1024ULL * 1024ULL,
195 .rlim_max = run->global->exe.asLimit * 1024ULL * 1024ULL,
196 };
197 if (setrlimit(RLIMIT_AS, &rl) == -1) {
198 PLOG_W("Couldn't enforce the RLIMIT_AS resource limit, ignoring");
199 }
200 }
201 #endif /* ifdef RLIMIT_AS */
202 #ifdef RLIMIT_RSS
203 if (run->global->exe.rssLimit) {
204 const struct rlimit rl = {
205 .rlim_cur = run->global->exe.rssLimit * 1024ULL * 1024ULL,
206 .rlim_max = run->global->exe.rssLimit * 1024ULL * 1024ULL,
207 };
208 if (setrlimit(RLIMIT_RSS, &rl) == -1) {
209 PLOG_W("Couldn't enforce the RLIMIT_RSS resource limit, ignoring");
210 }
211 }
212 #endif /* ifdef RLIMIT_RSS */
213 #ifdef RLIMIT_DATA
214 if (run->global->exe.dataLimit) {
215 const struct rlimit rl = {
216 .rlim_cur = run->global->exe.dataLimit * 1024ULL * 1024ULL,
217 .rlim_max = run->global->exe.dataLimit * 1024ULL * 1024ULL,
218 };
219 if (setrlimit(RLIMIT_DATA, &rl) == -1) {
220 PLOG_W("Couldn't enforce the RLIMIT_DATA resource limit, ignoring");
221 }
222 }
223 #endif /* ifdef RLIMIT_DATA */
224 #ifdef RLIMIT_CORE
225 const struct rlimit rl = {
226 .rlim_cur = run->global->exe.coreLimit * 1024ULL * 1024ULL,
227 .rlim_max = run->global->exe.coreLimit * 1024ULL * 1024ULL,
228 };
229 if (setrlimit(RLIMIT_CORE, &rl) == -1) {
230 PLOG_W("Couldn't enforce the RLIMIT_CORE resource limit, ignoring");
231 }
232 #endif /* ifdef RLIMIT_CORE */
233
234 if (run->global->exe.clearEnv) {
235 environ = NULL;
236 }
237 for (size_t i = 0; i < ARRAYSIZE(run->global->exe.envs) && run->global->exe.envs[i]; i++) {
238 putenv(run->global->exe.envs[i]);
239 }
240 char fuzzNo[128];
241 snprintf(fuzzNo, sizeof(fuzzNo), "%" PRId32, run->fuzzNo);
242 setenv(_HF_THREAD_NO_ENV, fuzzNo, 1);
243 if (run->global->exe.netDriver) {
244 setenv(_HF_THREAD_NETDRIVER_ENV, "1", 1);
245 }
246
247 /* Make sure it's a new process group / session, so waitpid can wait for -(run->pid) */
248 setsid();
249
250 util_closeStdio(/* close_stdin= */ run->global->exe.nullifyStdio,
251 /* close_stdout= */ run->global->exe.nullifyStdio,
252 /* close_stderr= */ run->global->exe.nullifyStdio);
253
254 /* The bitmap structure */
255 if (run->global->feedback.bbFd != -1 && dup2(run->global->feedback.bbFd, _HF_BITMAP_FD) == -1) {
256 PLOG_E("dup2(%d, _HF_BITMAP_FD=%d)", run->global->feedback.bbFd, _HF_BITMAP_FD);
257 return false;
258 }
259
260 /* The input file to _HF_INPUT_FD */
261 if (run->global->exe.persistent && dup2(run->dynamicFileFd, _HF_INPUT_FD) == -1) {
262 PLOG_E("dup2('%d', _HF_INPUT_FD='%d')", run->dynamicFileFd, _HF_INPUT_FD);
263 return false;
264 }
265
266 /* The log FD */
267 if ((run->global->exe.netDriver || run->global->exe.persistent)) {
268 if (dup2(logFd(), _HF_LOG_FD) == -1) {
269 PLOG_E("dup2(%d, _HF_LOG_FD=%d)", logFd(), _HF_LOG_FD);
270 return false;
271 }
272 char llstr[32];
273 snprintf(llstr, sizeof(llstr), "%d", logGetLevel());
274 setenv(_HF_LOG_LEVEL_ENV, llstr, 1);
275 }
276
277 sigset_t sset;
278 sigemptyset(&sset);
279 if (sigprocmask(SIG_SETMASK, &sset, NULL) == -1) {
280 PLOG_W("sigprocmask(empty_set)");
281 }
282
283 if (!run->global->exe.persistent) {
284 if ((run->dynamicFileCopyFd = files_writeBufToTmpFile(
285 run->global->io.workDir, run->dynamicFile, run->dynamicFileSz, 0)) == -1) {
286 LOG_E("Couldn't save data to a temporary file");
287 return false;
288 }
289 if (run->global->exe.fuzzStdin && dup2(run->dynamicFileCopyFd, STDIN_FILENO) == -1) {
290 PLOG_E("dup2(_HF_INPUT_FD=%d, STDIN_FILENO=%d)", run->dynamicFileCopyFd, STDIN_FILENO);
291 return false;
292 }
293 }
294
295 return true;
296 }
297
subproc_New(run_t * run)298 static bool subproc_New(run_t* run) {
299 if (run->pid) {
300 return true;
301 }
302
303 int sv[2];
304 if (run->global->exe.persistent) {
305 if (run->persistentSock != -1) {
306 close(run->persistentSock);
307 }
308
309 int sock_type = SOCK_STREAM;
310 #if defined(SOCK_CLOEXEC)
311 sock_type |= SOCK_CLOEXEC;
312 #endif
313 if (socketpair(AF_UNIX, sock_type, 0, sv) == -1) {
314 PLOG_W("socketpair(AF_UNIX, SOCK_STREAM, 0, sv)");
315 return false;
316 }
317 run->persistentSock = sv[0];
318 }
319
320 LOG_D("Forking new process for thread: %" PRId32, run->fuzzNo);
321
322 run->pid = arch_fork(run);
323 if (run->pid == -1) {
324 PLOG_E("Couldn't fork");
325 run->pid = 0;
326 return false;
327 }
328 /* The child process */
329 if (!run->pid) {
330 logMutexReset();
331 /*
332 * Reset sighandlers, and set alarm(1). It's a guarantee against dead-locks
333 * in the child, where we ensure here that the child process will either
334 * execve or get signaled by SIGALRM within 1 second.
335 *
336 * Those deadlocks typically stem from the fact, that malloc() can behave weirdly
337 * when fork()-ing a single thread of a process: e.g. with glibc < 2.24
338 * (or, Ubuntu's 2.23-0ubuntu6). For more see
339 * http://changelogs.ubuntu.com/changelogs/pool/main/g/glibc/glibc_2.23-0ubuntu7/changelog
340 */
341 alarm(1);
342 signal(SIGALRM, SIG_DFL);
343
344 if (run->global->exe.persistent) {
345 if (dup2(sv[1], _HF_PERSISTENT_FD) == -1) {
346 PLOG_F("dup2('%d', '%d')", sv[1], _HF_PERSISTENT_FD);
347 }
348 close(sv[0]);
349 close(sv[1]);
350 }
351
352 if (!subproc_PrepareExecv(run)) {
353 LOG_E("subproc_PrepareExecv() failed");
354 exit(EXIT_FAILURE);
355 }
356 if (!arch_launchChild(run)) {
357 LOG_E("Error launching child process");
358 kill(run->global->threads.mainPid, SIGTERM);
359 _exit(1);
360 }
361 abort();
362 }
363
364 /* Parent */
365 LOG_D("Launched new process, pid=%d, thread: %" PRId32 " (concurrency: %zd)", (int)run->pid,
366 run->fuzzNo, run->global->threads.threadsMax);
367
368 arch_prepareParentAfterFork(run);
369
370 if (run->global->exe.persistent) {
371 close(sv[1]);
372 run->runState = _HF_RS_WAITING_FOR_INITIAL_READY;
373 LOG_I("Persistent mode: Launched new persistent pid=%d", (int)run->pid);
374 }
375
376 return true;
377 }
378
subproc_Run(run_t * run)379 bool subproc_Run(run_t* run) {
380 run->timeStartedMillis = util_timeNowMillis();
381
382 if (!subproc_New(run)) {
383 LOG_E("subproc_New()");
384 return false;
385 }
386
387 arch_prepareParent(run);
388 arch_reapChild(run);
389
390 return true;
391 }
392
subproc_System(run_t * run,const char * const argv[])393 uint8_t subproc_System(run_t* run, const char* const argv[]) {
394 pid_t pid = arch_fork(run);
395 if (pid == -1) {
396 PLOG_E("Couldn't fork");
397 return 255;
398 }
399 if (!pid) {
400 logMutexReset();
401
402 setsid();
403 util_closeStdio(
404 /* close_stdin= */ true, /* close_stdout= */ false, /* close_stderr= */ false);
405
406 sigset_t sset;
407 sigemptyset(&sset);
408 if (sigprocmask(SIG_SETMASK, &sset, NULL) == -1) {
409 PLOG_W("sigprocmask(empty_set)");
410 }
411
412 execv(argv[0], (char* const*)&argv[0]);
413 PLOG_F("Couldn't execute '%s'", argv[0]);
414 return 255;
415 }
416
417 int flags = 0;
418 #if defined(__WNOTHREAD)
419 flags |= __WNOTHREAD;
420 #endif /* defined(__WNOTHREAD) */
421 #if defined(__WALL)
422 flags |= __WALL;
423 #endif /* defined(__WALL) */
424
425 for (;;) {
426 int status;
427 int ret = wait4(pid, &status, flags, NULL);
428 if (ret == -1 && errno == EINTR) {
429 continue;
430 }
431 if (ret == -1) {
432 PLOG_E("wait4() for process pid=%d", (int)pid);
433 return 255;
434 }
435 if (ret != pid) {
436 LOG_E("wait4() returned %d, but waited for %d", ret, (int)pid);
437 return 255;
438 }
439 if (WIFSIGNALED(status)) {
440 LOG_E("Command '%s' terminated with signal: %d", argv[0], WTERMSIG(status));
441 return (100 + WTERMSIG(status));
442 }
443 if (WIFEXITED(status)) {
444 if (WEXITSTATUS(status) == 0) {
445 return 0U;
446 }
447 LOG_E("Command '%s' returned with exit code %d", argv[0], WEXITSTATUS(status));
448 return 1U;
449 }
450
451 LOG_D("wait4() returned with status: %d", status);
452 }
453 }
454
subproc_checkTimeLimit(run_t * run)455 void subproc_checkTimeLimit(run_t* run) {
456 if (!run->global->timing.tmOut) {
457 return;
458 }
459
460 int64_t curMillis = util_timeNowMillis();
461 int64_t diffMillis = curMillis - run->timeStartedMillis;
462
463 if (run->tmOutSignaled && (diffMillis > ((run->global->timing.tmOut + 1) * 1000))) {
464 /* Has this instance been already signaled due to timeout? Just, SIGKILL it */
465 LOG_W("pid=%d has already been signaled due to timeout. Killing it with SIGKILL", run->pid);
466 kill(run->pid, SIGKILL);
467 return;
468 }
469
470 if ((diffMillis > (run->global->timing.tmOut * 1000)) && !run->tmOutSignaled) {
471 run->tmOutSignaled = true;
472 LOG_W("pid=%d took too much time (limit %ld s). Killing it with %s", (int)run->pid,
473 (long)run->global->timing.tmOut,
474 run->global->timing.tmoutVTALRM ? "SIGVTALRM" : "SIGKILL");
475 if (run->global->timing.tmoutVTALRM) {
476 kill(run->pid, SIGVTALRM);
477 } else {
478 kill(run->pid, SIGKILL);
479 }
480 ATOMIC_POST_INC(run->global->cnts.timeoutedCnt);
481 }
482 }
483
subproc_checkTermination(run_t * run)484 void subproc_checkTermination(run_t* run) {
485 if (fuzz_isTerminating()) {
486 LOG_D("Killing pid=%d", (int)run->pid);
487 kill(run->pid, SIGKILL);
488 }
489 }
490
subproc_runThread(honggfuzz_t * hfuzz,pthread_t * thread,void * (* thread_func)(void *))491 bool subproc_runThread(honggfuzz_t* hfuzz, pthread_t* thread, void* (*thread_func)(void*)) {
492 pthread_attr_t attr;
493
494 pthread_attr_init(&attr);
495 pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
496 pthread_attr_setstacksize(&attr, _HF_PTHREAD_STACKSIZE);
497 pthread_attr_setguardsize(&attr, (size_t)sysconf(_SC_PAGESIZE));
498
499 if (pthread_create(thread, &attr, thread_func, (void*)hfuzz) < 0) {
500 PLOG_W("Couldn't create a new thread");
501 return false;
502 }
503
504 pthread_attr_destroy(&attr);
505
506 return true;
507 }
508