1 // Copyright 2018 The Chromium OS Authors. All rights reserved.
2 //
3 // Redistribution and use in source and binary forms, with or without
4 // modification, are permitted provided that the following conditions are
5 // met:
6 //
7 // * Redistributions of source code must retain the above copyright
8 // notice, this list of conditions and the following disclaimer.
9 // * Redistributions in binary form must reproduce the above
10 // copyright notice, this list of conditions and the following disclaimer
11 // in the documentation and/or other materials provided with the
12 // distribution.
13 // * Neither the name of Google Inc. nor the names of its
14 // contributors may be used to endorse or promote products derived from
15 // this software without specific prior written permission.
16 //
17 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
20 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
21 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
22 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
23 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
27 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28
29 // libfuzzer-based fuzzer for public APIs.
30
31 #include <assert.h>
32 #include <stdint.h>
33 #include <stdlib.h>
34 #include <string.h>
35 #include <unistd.h>
36
37 #include <epoxy/egl.h>
38
39 #include "virglrenderer.h"
40
41 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size);
42
43 #ifndef CLEANUP_EACH_INPUT
44 // eglInitialize leaks unless eglTeriminate is called (which only happens
45 // with CLEANUP_EACH_INPUT), so suppress leak detection on everything
46 // allocated by it.
47 const char* __lsan_default_suppressions(void);
__lsan_default_suppressions()48 const char* __lsan_default_suppressions() {
49 return "leak:eglInitialize\n";
50 }
51
52 #endif // !CLEANUP_EACH_INPUT
53
54 struct fuzzer_cookie
55 {
56 EGLDisplay display;
57 EGLConfig egl_config;
58 EGLContext ctx;
59 };
60
fuzzer_write_fence(void * opaque,uint32_t fence)61 static void fuzzer_write_fence(void *opaque, uint32_t fence)
62 {
63 }
64
fuzzer_create_gl_context(void * cookie,int scanout_idx,struct virgl_renderer_gl_ctx_param * param)65 static virgl_renderer_gl_context fuzzer_create_gl_context(
66 void *cookie, int scanout_idx, struct virgl_renderer_gl_ctx_param *param)
67 {
68 struct fuzzer_cookie *cookie_data = cookie;
69 EGLContext shared = param->shared ? eglGetCurrentContext() : NULL;
70 const EGLint context_attribs[] = { EGL_CONTEXT_CLIENT_VERSION, 3,
71 EGL_NONE };
72 EGLContext ctx = eglCreateContext(cookie_data->display,
73 cookie_data->egl_config,
74 shared,
75 context_attribs);
76 assert(ctx);
77
78 return ctx;
79 }
80
fuzzer_destroy_gl_context(void * cookie,virgl_renderer_gl_context ctx)81 static void fuzzer_destroy_gl_context(void *cookie,
82 virgl_renderer_gl_context ctx)
83 {
84 struct fuzzer_cookie *cookie_data = cookie;
85 eglDestroyContext(cookie_data->display, ctx);
86 }
87
fuzzer_make_current(void * cookie,int scanout_idx,virgl_renderer_gl_context ctx)88 static int fuzzer_make_current(void *cookie, int scanout_idx, virgl_renderer_gl_context ctx)
89 {
90 return 0;
91 }
92
93 const int FUZZER_CTX_ID = 1;
94 const char *SWRAST_ENV = "LIBGL_ALWAYS_SOFTWARE";
95
96 static struct fuzzer_cookie cookie;
97
98 static struct virgl_renderer_callbacks fuzzer_cbs = {
99 .version = 1,
100 .write_fence = fuzzer_write_fence,
101 .create_gl_context = fuzzer_create_gl_context,
102 .destroy_gl_context = fuzzer_destroy_gl_context,
103 .make_current = fuzzer_make_current,
104 };
105
106 static bool initialized = false;
107
initialize_environment()108 static int initialize_environment()
109 {
110 if (!initialized) {
111 EGLBoolean ok;
112
113 // Force SW rendering unless env variable is already set.
114 setenv(SWRAST_ENV, "true", 0);
115
116 cookie.display = eglGetDisplay(EGL_DEFAULT_DISPLAY);
117 assert(cookie.display != EGL_NO_DISPLAY);
118
119 ok = eglInitialize(cookie.display, NULL, NULL);
120 assert(ok);
121
122 const EGLint config_attribs[] = { EGL_SURFACE_TYPE, EGL_DONT_CARE,
123 EGL_NONE };
124 EGLint num_configs;
125 ok = eglChooseConfig(cookie.display, config_attribs,
126 &cookie.egl_config, 1, &num_configs);
127 assert(ok);
128
129 ok = eglBindAPI(EGL_OPENGL_ES_API);
130 assert(ok);
131
132 const EGLint context_attribs[] = { EGL_CONTEXT_CLIENT_VERSION, 3,
133 EGL_NONE };
134 cookie.ctx = eglCreateContext(cookie.display, cookie.egl_config,
135 EGL_NO_CONTEXT, context_attribs);
136 assert(cookie.ctx != EGL_NO_CONTEXT);
137
138 ok = eglMakeCurrent(cookie.display, EGL_NO_SURFACE, EGL_NO_SURFACE,
139 cookie.ctx);
140 assert(ok);
141
142 initialized = true;
143 }
144
145 return FUZZER_CTX_ID;
146 }
147
148 #ifdef CLEANUP_EACH_INPUT
cleanup_environment()149 static void cleanup_environment()
150 {
151 if (cookie.ctx != EGL_NO_CONTEXT) {
152 eglMakeCurrent(cookie.display, NULL, NULL, NULL);
153 eglDestroyContext(cookie.display, cookie.ctx);
154 }
155
156 if (cookie.display != EGL_NO_DISPLAY) {
157 eglTerminate(cookie.display);
158 }
159
160 initialized = false;
161 }
162 #endif
163
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)164 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
165 {
166 uint32_t ctx_id = initialize_environment();
167 int ret;
168
169 // There are trade-offs here between ensuring that state is not persisted
170 // between invocations of virgl_renderer_submit_cmd, and to avoid leaking
171 // resources that comes with repeated dlopen()/dlclose()ing the mesa
172 // driver with each eglInitialize()/eglTerminate() if CLEANUP_EACH_INPUT
173 // is set.
174
175 ret = virgl_renderer_init(&cookie, 0, &fuzzer_cbs);
176 assert(!ret);
177
178 const char *name = "fuzzctx";
179 ret = virgl_renderer_context_create(ctx_id, strlen(name), name);
180 assert(!ret);
181
182 virgl_renderer_submit_cmd((void *) data, ctx_id, size / sizeof(uint32_t));
183
184 virgl_renderer_context_destroy(ctx_id);
185
186 virgl_renderer_cleanup(&cookie);
187
188 #ifdef CLEANUP_EACH_INPUT
189 // The following cleans up between each input which is a lot slower.
190 cleanup_environment();
191 #endif
192
193 return 0;
194 }
195