1 /*
2 * Copyright (C) 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <BpBinderFuzzFunctions.h>
18 #include <IBinderFuzzFunctions.h>
19 #include <commonFuzzHelpers.h>
20 #include <fuzzer/FuzzedDataProvider.h>
21
22 #include <android-base/logging.h>
23 #include <binder/BpBinder.h>
24 #include <binder/IServiceManager.h>
25 #include <binder/RpcServer.h>
26 #include <binder/RpcSession.h>
27
28 #include <signal.h>
29 #include <sys/prctl.h>
30 #include <thread>
31
32 namespace android {
33
34 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)35 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
36 FuzzedDataProvider fdp(data, size);
37
38 std::string addr = std::string(getenv("TMPDIR") ?: "/tmp") + "/binderRpcBenchmark";
39 if (0 != unlink(addr.c_str()) && errno != ENOENT) {
40 LOG(WARNING) << "Could not unlink: " << strerror(errno);
41 }
42
43 sp<RpcServer> server = RpcServer::make();
44
45 // use RPC binder because fuzzer can't get coverage from another process.
46 auto thread = std::thread([&]() {
47 prctl(PR_SET_PDEATHSIG, SIGHUP); // racey, okay
48 server->setRootObject(sp<BBinder>::make());
49 CHECK_EQ(OK, server->setupUnixDomainServer(addr.c_str()));
50 server->join();
51 });
52
53 sp<RpcSession> session = RpcSession::make();
54 session->setMaxIncomingThreads(1);
55 status_t status;
56
57 // b/274084938 - ASAN may be slow, wait a while
58 for (size_t tries = 0; tries < 50; tries++) {
59 usleep(100000);
60 status = session->setupUnixDomainClient(addr.c_str());
61 if (status == OK) break;
62 }
63 CHECK_EQ(status, OK) << "Unable to connect";
64
65 sp<BpBinder> bpBinder = session->getRootObject()->remoteBinder();
66
67 // To prevent memory from running out from calling too many add item operations.
68 const uint32_t MAX_RUNS = 2048;
69 uint32_t count = 0;
70 sp<IBinder::DeathRecipient> s_recipient = new FuzzDeathRecipient();
71
72 while (fdp.remaining_bytes() > 0 && count++ < MAX_RUNS) {
73 if (fdp.ConsumeBool()) {
74 callArbitraryFunction(&fdp, gBPBinderOperations, bpBinder, s_recipient);
75 } else {
76 callArbitraryFunction(&fdp, gIBinderOperations, bpBinder.get());
77 }
78 }
79
80 CHECK(session->shutdownAndWait(true)) << "couldn't shutdown session";
81 CHECK(server->shutdown()) << "couldn't shutdown server";
82 thread.join();
83
84 return 0;
85 }
86 } // namespace android
87