1 // Copyright 2024 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #ifdef UNSAFE_BUFFERS_BUILD
6 // TODO(crbug.com/351564777): Remove this and convert code to safer constructs.
7 #pragma allow_unsafe_buffers
8 #endif
9
10 #include "base/containers/span.h"
11 #include "base/files/file.h"
12 #include "base/logging.h"
13 #include "base/ranges/algorithm.h"
14 #include "base/threading/thread_restrictions.h"
15 #include "v8/src/fuzzilli/cov.h"
16
17 #define WEAK_SANCOV_DEF(return_type, name, ...) \
18 extern "C" __attribute__((visibility("default"))) __attribute__((weak)) \
19 return_type \
20 name(__VA_ARGS__)
21
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_cmp,void)22 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_cmp, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_cmp1,void)23 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_cmp1, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_cmp2,void)24 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_cmp2, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_cmp4,void)25 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_cmp4, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_cmp8,void)26 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_cmp8, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_const_cmp1,void)27 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_const_cmp1, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_const_cmp2,void)28 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_const_cmp2, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_const_cmp4,void)29 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_const_cmp4, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_const_cmp8,void)30 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_const_cmp8, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_switch,void)31 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_switch, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_div4,void)32 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_div4, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_div8,void)33 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_div8, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_gep,void)34 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_gep, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_pc_indir,void)35 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_pc_indir, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_8bit_counters_init,void)36 WEAK_SANCOV_DEF(void, __sanitizer_cov_8bit_counters_init, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_bool_flag_init,void)37 WEAK_SANCOV_DEF(void, __sanitizer_cov_bool_flag_init, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_pcs_init,void)38 WEAK_SANCOV_DEF(void, __sanitizer_cov_pcs_init, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_cfs_init,void)39 WEAK_SANCOV_DEF(void, __sanitizer_cov_cfs_init, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_pc_guard,void)40 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_pc_guard, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_trace_pc_guard_init,void)41 WEAK_SANCOV_DEF(void, __sanitizer_cov_trace_pc_guard_init, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_load1,void)42 WEAK_SANCOV_DEF(void, __sanitizer_cov_load1, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_load2,void)43 WEAK_SANCOV_DEF(void, __sanitizer_cov_load2, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_load4,void)44 WEAK_SANCOV_DEF(void, __sanitizer_cov_load4, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_load8,void)45 WEAK_SANCOV_DEF(void, __sanitizer_cov_load8, void) {}
WEAK_SANCOV_DEF(void,__sanitizer_cov_load16,void)46 WEAK_SANCOV_DEF(void, __sanitizer_cov_load16, void) {}
47
48 // File descriptors used for communication with Fuzzilli.
49 constexpr base::PlatformFile kControlReadFd = 100;
50 constexpr base::PlatformFile kControlWriteFd = 101;
51 constexpr base::PlatformFile kDataReadFd = 102;
52
LLVMFuzzerRunDriverImpl(int * argc,char *** argv,int (* UserCb)(const uint8_t * Data,size_t Size))53 int LLVMFuzzerRunDriverImpl(int* argc,
54 char*** argv,
55 int (*UserCb)(const uint8_t* Data, size_t Size)) {
56 // Allow blocking for the whole fuzzing session.
57 base::ScopedAllowBlockingForTesting allow_blocking;
58 // Open files for communication with Fuzzilli.
59 auto ctrl_read_file = base::File(base::ScopedPlatformFile(kControlReadFd));
60 auto ctrl_write_file = base::File(base::ScopedPlatformFile(kControlWriteFd));
61 auto data_read_file = base::File(base::ScopedPlatformFile(kDataReadFd));
62
63 // Send the "HELO" message to Fuzzilli to establish communication.
64 constexpr auto kHelloMessage = base::span_from_cstring("HELO");
65 constexpr size_t kExpectedSize = kHelloMessage.size();
66 static_assert(kExpectedSize == 4);
67
68 ctrl_write_file.WriteAtCurrentPosAndCheck(base::as_bytes(kHelloMessage));
69 char actual_magic[kExpectedSize] = {};
70 ctrl_read_file.ReadAtCurrentPosAndCheck(
71 base::as_writable_byte_span(actual_magic));
72
73 CHECK(base::ranges::equal(kHelloMessage, actual_magic));
74
75 while (true) {
76 // Read the action message ("exec") from Fuzzilli.
77 constexpr auto kExpectedAction = base::span_from_cstring("exec");
78 uint8_t action_msg[kExpectedAction.size()];
79 if (!ctrl_read_file.ReadAtCurrentPosAndCheck(base::span(action_msg)) ||
80 !base::ranges::equal(kExpectedAction, action_msg)) {
81 LOG(WARNING) << "Unexpected message from Fuzzilli: " << action_msg;
82 return 0;
83 }
84
85 // Read the size of the JavaScript script from Fuzzilli.
86 uint64_t script_size = 0;
87 ctrl_read_file.ReadAtCurrentPosAndCheck(
88 base::as_writable_bytes(base::span_from_ref(script_size)));
89
90 // Read the JavaScript script from Fuzzilli.
91 std::vector<uint8_t> buffer(script_size + 1);
92 data_read_file.ReadAtCurrentPosAndCheck(
93 base::span(buffer.data(), script_size));
94 buffer[script_size] = 0;
95
96 // Run the script:
97 int status = UserCb(buffer.data(), script_size) ? 1 << 8 : 0;
98
99 // Fuzzilli status is similar to the Linux return status. Lower 8 bits are
100 // used for signals, and higher 8 bits for return code.
101 ctrl_write_file.WriteAtCurrentPosAndCheck(base::byte_span_from_ref(status));
102
103 // After every iteration, we reset the coverage edges so that we can mark
104 // which edges are hit in the next iteration. This is needed by Fuzzilli
105 // instrumentation.
106 sanitizer_cov_reset_edgeguards();
107 }
108 }
109
LLVMFuzzerRunDriver(int * argc,char *** argv,int (* UserCb)(const uint8_t * Data,size_t Size))110 extern "C" int LLVMFuzzerRunDriver(int* argc,
111 char*** argv,
112 int (*UserCb)(const uint8_t* Data,
113 size_t Size)) {
114 return LLVMFuzzerRunDriverImpl(argc, argv, UserCb);
115 }
116