1 /*
2 * Copyright (C) 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <aidl/transaction_ids.h>
18 #include <fuzzbinder/libbinder_driver.h>
19
20 #include <fuzzbinder/random_parcel.h>
21
22 #include <android-base/logging.h>
23 #include <binder/IPCThreadState.h>
24 #include <binder/ProcessState.h>
25
26 #include <private/android_filesystem_config.h>
27
28 using android::binder::unique_fd;
29
30 namespace android {
31
fuzzService(const sp<IBinder> & binder,FuzzedDataProvider && provider)32 void fuzzService(const sp<IBinder>& binder, FuzzedDataProvider&& provider) {
33 fuzzService(std::vector<sp<IBinder>>{binder}, std::move(provider));
34 }
35
getCode(FuzzedDataProvider & provider)36 uint32_t getCode(FuzzedDataProvider& provider) {
37 if (provider.ConsumeBool()) {
38 return provider.ConsumeIntegral<uint32_t>();
39 }
40
41 // Most of the AIDL services will have small set of transaction codes.
42 if (provider.ConsumeBool()) {
43 return provider.ConsumeIntegralInRange<uint32_t>(0, 100);
44 }
45
46 if (provider.ConsumeBool()) {
47 return provider.PickValueInArray<uint32_t>(
48 {IBinder::DUMP_TRANSACTION, IBinder::PING_TRANSACTION,
49 IBinder::SHELL_COMMAND_TRANSACTION, IBinder::INTERFACE_TRANSACTION,
50 IBinder::SYSPROPS_TRANSACTION, IBinder::EXTENSION_TRANSACTION,
51 IBinder::TWEET_TRANSACTION, IBinder::LIKE_TRANSACTION});
52 }
53
54 return provider.ConsumeIntegralInRange<uint32_t>(aidl::kLastMetaMethodId,
55 aidl::kFirstMetaMethodId);
56 }
57
fuzzService(const std::vector<sp<IBinder>> & binders,FuzzedDataProvider && provider)58 void fuzzService(const std::vector<sp<IBinder>>& binders, FuzzedDataProvider&& provider) {
59 RandomParcelOptions options{
60 .extraBinders = binders,
61 .extraFds = {},
62 };
63
64 // Reserved bytes so that we don't have to change fuzzers and seed corpus if
65 // we introduce anything new in fuzzService.
66 std::vector<uint8_t> reservedBytes = provider.ConsumeBytes<uint8_t>(8);
67 (void)reservedBytes;
68
69 // always refresh the calling identity, because we sometimes set it below, but also,
70 // the code we're fuzzing might reset it
71 IPCThreadState::self()->clearCallingIdentity();
72
73 // Always take so that a perturbation of just the one ConsumeBool byte will always
74 // take the same path, but with a different UID. Without this, the fuzzer needs to
75 // guess both the change in value and the shift at the same time.
76 int64_t maybeSetUid = provider.PickValueInArray<int64_t>(
77 {static_cast<int64_t>(AID_ROOT) << 32, static_cast<int64_t>(AID_SYSTEM) << 32,
78 provider.ConsumeIntegralInRange<int64_t>(static_cast<int64_t>(AID_ROOT) << 32,
79 static_cast<int64_t>(AID_USER) << 32),
80 provider.ConsumeIntegral<int64_t>()});
81
82 if (provider.ConsumeBool()) {
83 // set calling uid
84 IPCThreadState::self()->restoreCallingIdentity(maybeSetUid);
85 }
86
87 while (provider.remaining_bytes() > 0) {
88 uint32_t code = getCode(provider);
89 uint32_t flags = provider.ConsumeIntegral<uint32_t>();
90 Parcel data;
91 // for increased fuzz coverage
92 data.setEnforceNoDataAvail(false);
93 data.setServiceFuzzing();
94
95 sp<IBinder> target = options.extraBinders.at(
96 provider.ConsumeIntegralInRange<size_t>(0, options.extraBinders.size() - 1));
97 options.writeHeader = [&target](Parcel* p, FuzzedDataProvider& provider) {
98 // most code will be behind checks that the head of the Parcel
99 // is exactly this, so make it easier for fuzzers to reach this
100 if (provider.ConsumeBool()) {
101 p->writeInterfaceToken(target->getInterfaceDescriptor());
102 }
103 };
104
105 std::vector<uint8_t> subData = provider.ConsumeBytes<uint8_t>(
106 provider.ConsumeIntegralInRange<size_t>(0, provider.remaining_bytes()));
107 fillRandomParcel(&data, FuzzedDataProvider(subData.data(), subData.size()), &options);
108
109 Parcel reply;
110 // for increased fuzz coverage
111 reply.setEnforceNoDataAvail(false);
112 reply.setServiceFuzzing();
113 (void)target->transact(code, data, &reply, flags);
114
115 // feed back in binders and fds that are returned from the service, so that
116 // we can fuzz those binders, and use the fds and binders to feed back into
117 // the binders
118 auto retBinders = reply.debugReadAllStrongBinders();
119 options.extraBinders.insert(options.extraBinders.end(), retBinders.begin(),
120 retBinders.end());
121 auto retFds = reply.debugReadAllFileDescriptors();
122 for (size_t i = 0; i < retFds.size(); i++) {
123 options.extraFds.push_back(unique_fd(dup(retFds[i])));
124 }
125 }
126
127 // invariants
128 auto ps = ProcessState::selfOrNull();
129 if (ps) {
130 CHECK_EQ(0, ps->getThreadPoolMaxTotalThreadCount())
131 << "Binder threadpool should not be started by fuzzer because coverage can only "
132 "cover in-process calls.";
133 }
134 }
135
136 } // namespace android
137